Re: How to copy ACLs from one OU to another?

Sounds like a good design, I suggest you for go with the dsacls tool.
Search on Google for "dsacls" to find the syntax.

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup
------------------------------------------------
http://www.chrisse.se - Active Directory Tips

"D Dub" <DDub@xxxxxxxxxxxxxxxxxxxxxxxxx> skrev i meddelandet
news:9A436812-9811-46B4-8A33-C1035D7067CF@xxxxxxxxxxxxxxxx
> Thanks for your reply.
>
> On the design question... Maybe an example will make my situation clearer.
> I
> have an OU for each remote office (City), and under the City OU are 3 OUs,
> one each for Users, Groups, and Computers. I want to grant local and
> corporate personnel certain priveleges for administration in these OUs,
> but
> only allowing user objects to exist in the Users OU, only Groups in the
> Groups OU, etc. Then certain admin groups may have more or less rights--
> e.g.
> the local city admins may reset passwords and change group memberships,
> but
> only the corporate IT admins can create or delete users and groups. So,
> most
> of the permissioning is happening at the outside of the tree (on the last
> OU
> objects). This model will be replicated for 30 or more locations, so I
> would
> have to recreate all those custom permissions for the User/Group/Computer
> OUs
> under every other City OU.
>
> Does this design still pose a performance issue in your opinion?
>
> Thanks again...
>
>
> "Chriss3 [MVP]" wrote:
>
>> Hello,
>> This may is a design question? If you can change the design of your
>> directory to take use of inheritance I strongly recommend that. If you
>> have
>> the option to create a top level OU and put the others within it you can
>> inheritance the common permission to your child OUs.
>>
>> If you can't change your design to take use of inheritance, you can use
>> dsacls command line tool to easy specify the command that will set the
>> required permission and then just switch OU (DN) you want to apply the
>> permission to. There is more advanced ways as well the require scripting
>> or
>> coding, Have a look in the ADSI newsgroups as well.
>> --
>> Regards
>> Christoffer Andersson
>> Microsoft MVP - Directory Services
>>
>> No email replies please - reply in the newsgroup
>> ------------------------------------------------
>> http://www.chrisse.se - Active Directory Tips
>>
>> "D Dub" <DDub@xxxxxxxxxxxxxxxxxxxxxxxxx> skrev i meddelandet
>> news:9FB6688E-B758-4EC9-BF19-5281CA1A7A23@xxxxxxxxxxxxxxxx
>> > Hi All,
>> >
>> > I have to create some very detailed access permissions on a set of of
>> > OUs
>> > in
>> > AD (too granular to use the delegation wizard), and then duplicate
>> > those
>> > ACEs
>> > on the security descriptors of many other OUs in the directory. Is
>> > there a
>> > tool or method which will let me copy permissions between OUs in this
>> > way?
>> > I
>> > am trying to save myself hours of redundant manual permissioning
>> > throughout
>> > the tree.
>> >
>> > Any guidance would be greatly appreciated!
>> >
>> > Thank you.
>>
>>
>>


.

Relevant Pages

  • Re: Protecting Database frm being Imported into a new Database
    ... The permissions that you set on forms, reports, etc in an MDB file can ... users can see the design of the ... However, users can create a new database, import an object, and play ...
    (microsoft.public.access.security)
  • Re: How to copy ACLs from one OU to another?
    ... On the design question... ... have an OU for each remote office (City), and under the City OU are 3 OUs, ... have to recreate all those custom permissions for the User/Group/Computer OUs ... > directory to take use of inheritance I strongly recommend that. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Read design/read data problem
    ... An alternative is to deny all permissions on the tables, ... They won't be able to open tables directly, nor read their design. ... Create a startup form that is opened on ... If you need to bypass these startup features, you can hold the shift key ...
    (microsoft.public.access.security)
  • Re: Basing Object Permissions on Ownership
    ... >> design changes, etc. to objects that I've created but at the same time I ... Is there a way of assigning permissions to ... if a user has read design permissions on new queries but does ...
    (microsoft.public.access.security)
  • Re: NULLs
    ... of the phone number is in turn functionally dependant on the city. ... in the vast majority of applications, this is not useful at all. ... Persons, Street, HouseNo, PostalCode, City, PhoneNo) ... to be adequately normalized - even when purists would prefer a design ...
    (comp.databases.theory)
Loading