Re: How to copy ACLs from one OU to another?

Thanks for your reply.

On the design question... Maybe an example will make my situation clearer. I
have an OU for each remote office (City), and under the City OU are 3 OUs,
one each for Users, Groups, and Computers. I want to grant local and
corporate personnel certain priveleges for administration in these OUs, but
only allowing user objects to exist in the Users OU, only Groups in the
Groups OU, etc. Then certain admin groups may have more or less rights-- e.g.
the local city admins may reset passwords and change group memberships, but
only the corporate IT admins can create or delete users and groups. So, most
of the permissioning is happening at the outside of the tree (on the last OU
objects). This model will be replicated for 30 or more locations, so I would
have to recreate all those custom permissions for the User/Group/Computer OUs
under every other City OU.

Does this design still pose a performance issue in your opinion?

Thanks again...


"Chriss3 [MVP]" wrote:

> Hello,
> This may is a design question? If you can change the design of your
> directory to take use of inheritance I strongly recommend that. If you have
> the option to create a top level OU and put the others within it you can
> inheritance the common permission to your child OUs.
>
> If you can't change your design to take use of inheritance, you can use
> dsacls command line tool to easy specify the command that will set the
> required permission and then just switch OU (DN) you want to apply the
> permission to. There is more advanced ways as well the require scripting or
> coding, Have a look in the ADSI newsgroups as well.
> --
> Regards
> Christoffer Andersson
> Microsoft MVP - Directory Services
>
> No email replies please - reply in the newsgroup
> ------------------------------------------------
> http://www.chrisse.se - Active Directory Tips
>
> "D Dub" <DDub@xxxxxxxxxxxxxxxxxxxxxxxxx> skrev i meddelandet
> news:9FB6688E-B758-4EC9-BF19-5281CA1A7A23@xxxxxxxxxxxxxxxx
> > Hi All,
> >
> > I have to create some very detailed access permissions on a set of of OUs
> > in
> > AD (too granular to use the delegation wizard), and then duplicate those
> > ACEs
> > on the security descriptors of many other OUs in the directory. Is there a
> > tool or method which will let me copy permissions between OUs in this way?
> > I
> > am trying to save myself hours of redundant manual permissioning
> > throughout
> > the tree.
> >
> > Any guidance would be greatly appreciated!
> >
> > Thank you.
>
>
>
.

Relevant Pages

  • Re: How to copy ACLs from one OU to another?
    ... Sounds like a good design, I suggest you for go with the dsacls tool. ... > have an OU for each remote office (City), and under the City OU are 3 OUs, ... > have to recreate all those custom permissions for the User/Group/Computer ...
    (microsoft.public.windows.server.active_directory)
  • Re: Protecting Database frm being Imported into a new Database
    ... The permissions that you set on forms, reports, etc in an MDB file can ... users can see the design of the ... However, users can create a new database, import an object, and play ...
    (microsoft.public.access.security)
  • Re: Read design/read data problem
    ... An alternative is to deny all permissions on the tables, ... They won't be able to open tables directly, nor read their design. ... Create a startup form that is opened on ... If you need to bypass these startup features, you can hold the shift key ...
    (microsoft.public.access.security)
  • Re: Basing Object Permissions on Ownership
    ... >> design changes, etc. to objects that I've created but at the same time I ... Is there a way of assigning permissions to ... if a user has read design permissions on new queries but does ...
    (microsoft.public.access.security)
  • Re: NULLs
    ... of the phone number is in turn functionally dependant on the city. ... in the vast majority of applications, this is not useful at all. ... Persons, Street, HouseNo, PostalCode, City, PhoneNo) ... to be adequately normalized - even when purists would prefer a design ...
    (comp.databases.theory)