Re: How to copy ACLs from one OU to another?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

"D Dub" <DDub@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:DDub@xxxxxxxxxxxxxxxxxxxxxxxxx:
> Hi All,
>
> I have to create some very detailed access permissions on a set of of OUs
> in
> AD (too granular to use the delegation wizard), and then duplicate those
> ACEs
> on the security descriptors of many other OUs in the directory. Is there a
>
> tool or method which will let me copy permissions between OUs in this way?
> I
> am trying to save myself hours of redundant manual permissioning
> throughout
> the tree.
>

Hello D Dub,

I've published a script to modify ACEs on specific objects (it copies
the ACEs from one DACL to a new one, modifies them in the process if
necessary, and then assigns the new DACL to the old object). You should
easily be able to modify that to meet your needs. Look at
http://www.windowsserverfaq.org/faq/CompACLs.asp

--
Gruesse - Sincerely,

Ulf B. Simon-Weidner

MVP-Book "Windows XP - Die Expertentipps": http://tinyurl.com/44zcz
Weblog: http://msmvps.org/UlfBSimonWeidner
WebSite: http://www.windowsserverfaq.org
.

Relevant Pages

  • Re: Want to turn permission propagation off in SetNamedSecurityInfo . . .
    ... The ACL and ACEs were pretty easy to parse, ... The object-specific ACEs are a bit weird and I ... determining the exact algorithms used to propagate the permissions. ... SE_FILE_OBJECT, read the dacl, then deleted any ACEs from the DACL ...
    (microsoft.public.platformsdk.security)
  • Re: NTFS Effective Permissions?
    ... why some folders seem to have a slightly different configuration of ACEs in ... created by a script that applies user-specific permissions always in the ... Just the mask - the flags were decimal. ... > the GUI to combinations of ACEs that can sensibly be adjusted by a user. ...
    (microsoft.public.scripting.wsh)
  • Re: How to copy ACLs from one OU to another?
    ... >> tool or method which will let me copy permissions between OUs in this way? ... > I've published a script to modify ACEs on specific objects (it copies ... and then assigns the new DACL to the old object). ...
    (microsoft.public.windows.server.active_directory)
  • Re: User Name
    ... you need to create ACEs (with the permissions that you want) within of the ... DACL of your file application. ... > the group he belongs to. ...
    (microsoft.public.win32.programmer.kernel)
  • Permissions again
    ... You posted code to list ACEs for an object ... It's fairly easy to set permissions. ... You sample code shows how to return ACEs ... If the CU is an Admin that could be a real ...
    (microsoft.public.vb.general.discussion)