Recently, I have been working a lot with PowerShell to automate the creation of a full AD site OU structure (with Group Policy and all) along with all the necessary delegated permissions. One of the limitation of the out of the box AD PowerShell commands is there is no easy way (but apparently there is a really hard way) to delegate permission to Active Directory OUâ€™s. Luckily Quest Software have helped a lot here and they have offered a set of FREE PowerShell commands for Active Directory called â€œActiveRoles Management Shell for Active Directoryâ€ one of which is called Add-QADPermission which greatly simplifies the process of delegation security in AD.
The Add-QADPermission command can be used to add an DACL security descriptor permission to any AD object with a distinguished name such as users, computer or OUâ€™s. Therefore you can use this to delegate permission to OU similarly to running a â€œDelegation of Control Wizardâ€ in Active Directory Users and Computers console (see image below).
This wizard allows you to delegate some common tasks (see below) to your OUâ€™s in you Active Directory however the permissions they apply are not straight forward simple permissions.
What I will show you how to do is how to perform some of the common delegation tasks that the â€œDelegation of Control Wizardâ€ using a PowerShell command so you can automate the process for creating new OUâ€™s in your environment. I know this is not strictly an Group Policy topic but it is one closely related and one I think many Group Policy admins will find useful.
The Command tasks I will show you are the oneâ€™s that I almost exclusively use when delegating permissions to Active Directory, they are:
- Create, delete and manage user accounts
- and Groups
- and Computers
- Reset user passwords and force password change at next logon
- Modify the membership of a group