37 KiB
Delegation-User-Attributes
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;displayName;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;sn;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;description;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;mail;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;targetAddress;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;proxyAddresses;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute1;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute2;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute3;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute4;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute5;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute6;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute7;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute8;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute9;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute10;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute11;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute12;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute13;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute14;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;extensionAttribute15;user" /I:S
Added 6/11/2019
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;department;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;postalCode;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;streetAddress;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;st;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;title;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;telephoneNumber;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;mobile;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;pager;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;company;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;L;user" /I:S
Added 9/9/2019
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;c;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;facsimileTelephoneNumber;user" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;physicalDeliveryOfficeName;user" /I:S
Added 4/4/2024 (as discussed with Marcus)
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-User-Attributes:RPWP;altSecurityIdentities;user" /I:S
New script to replace above…..
12-4-2024 Delegation "Delegation-User-Attributes"
Define the list of OUs
$ouList = @(
"OU=EastTexas,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=International,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NationalCapital,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NorthEast,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NorthWestCentral,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=SouthEast,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=SouthWest,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=West,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=Accounts Privileged,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=Accounts Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov"
)
Define the commands to execute for each OU
$commands = @(
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;displayName;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;sn;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;description;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;mail;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;targetAddress;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;proxyAddresses;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;mailNickname;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;directReports;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;manager;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute1;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute10;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute11;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute12;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute13;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute14;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute15;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute16;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute17;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute18;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute19;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute2;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute20;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute3;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute4;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute5;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute6;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute7;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute8;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;DHSAttribute9;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute1;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute2;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute3;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute4;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute5;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute6;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute7;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute8;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute9;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute10;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute11;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute12;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute13;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute14;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;extensionAttribute15;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;department;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;postalCode;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;streetAddress;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;st;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;title;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;telephoneNumber;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;mobile;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;pager;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;company;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;L;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;c;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;facsimileTelephoneNumber;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;physicalDeliveryOfficeName;user" /I:S',
'DSACLS "{0}" /G "Delegation-User-Attributes:RPWP;altSecurityIdentities;user" /I:S'
)
Loop through each OU and execute the commands
foreach ($ou in $ouList) {
foreach ($cmd in $commands) {
$commandToExecute = $cmd -f $ou
Write-Host "Executing: $commandToExecute"
Invoke-Expression $commandToExecute
}
}
Delegation-UserPIVmaint Added 12/5/2024
Define the list of OUs
$ouList = @(
"OU=EastTexas,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=International,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NationalCapital,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NorthEast,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=NorthWestCentral,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=SouthEast,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=SouthWest,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=West,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=Accounts Privileged,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov",
"OU=Accounts Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov"
)
Define the commands to execute for each OU
$commands = @(
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;account restrictions;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;pwdlastset;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;UserAccountControl;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;altSecurityIdentities;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:CA;reset password;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;DHSAttribute13;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;DHSAttribute19;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;userPrincipalName;user" /I:S',
'DSACLS "{0}" /G "Delegation-UserPIVmaint:RPWP;sAMAccountName;user" /I:S'
)
Loop through each OU and execute the commands
foreach ($ou in $ouList) {
foreach ($cmd in $commands) {
$commandToExecute = $cmd -f $ou
Write-Host "Executing: $commandToExecute"
Invoke-Expression $commandToExecute
}
}
==View==
dsacls "DC=ad,DC=cbp,DC=dhs,DC=gov" >ad.txt
Added 6/10/2019
==Service accounts servicePrincipalName delegation: Delegation-servicePrincipalName==
DSACLS "OU=Accounts Service,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-servicePrincipalName:RPWP;servicePrincipalName;user" /I:S
Added 6/18/2025
DSACLS "OU=SQL,OU=EIOD,OU=Accounts Group Managed System,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "DELEGATION-EIOD-SQL-SVC-ACCNT-MGMNT:RPWP;servicePrincipalName;user" /I:S
2/11/2022 SAT domain
DSACLS "OU=SQL,OU=EDMED,OU=Accounts Service,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "Delegation-servicePrincipalName-EDME-SQL:RPWP;servicePrincipalName;user" /I:S
Added 6/18/2025
DSACLS "OU=SQL,OU=EIOD,OU=Accounts Group Managed System,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "Delegation-servicePrincipalName-EDME-SQL:RPWP;servicePrincipalName;user" /I:S
Added 2/26/20 (so TSD or future groups can modify extensionAttribute11 used for email automation)
DSACLS "OU=Accounts Service,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "Delegation-extensionAttribute11:RPWP;extensionAttribute11;user" /I:S
How to grant "Write ServicePrincipalName” and “Write validated SPN” rights to the directory for service account
Tuesday, July 31, 2018
1:45 PM
How to grant "Write ServicePrincipalName” and “Write validated SPN” rights to the directory for service account
dsacls "OU=SQL,OU=EDMED,OU=Accounts Service,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\SG-SQL-OSADMINS:RPWP;servicePrincipalName"
Only users accounts
dsacls "OU=SQL,OU=EDMED,OU=Accounts Service,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\SG-SQL-OSADMINS:RPWP;servicePrincipalName;user"
==Delegation-msRTCSIP-Attributes Deleted 12/5/24 No Longer in use==
Kellerman 10/21/19:
-
Renamed original Delegation-msRTCSIP-PrimaryUserAddress to Delegation-msRTCSIP-Attributes to reflect multiple property assignments
-
Added the following WR (Write) to user properties (dsacls example shows only original delegation for msRTCSIP-PrimaryUserAddress):
- msRTCSIP-ApplicationOptions
- msRTCSIP-DeploymentLocator
- msRTCSIP-Line
- msRTCSIP-OptionFlags
- msRTCSIP-OwnerUrn
- msRTCSIP-PrimaryUserAddress
- msRTCSIP-UserEnabledmsRTCSIP-UserEnabled
dsacls "OU=Accounts Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=Arizona,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=Central,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=METRO,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=NorthEast,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=NorthWest,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=SouthEast,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=SouthernCalifornia,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=SouthWest,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
dsacls "OU=International,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-msRTCSIP-Attributes:WP;msRTCSIP-PrimaryUserAddress;user"
==Delegation-UserAccessControl== ==Deleted 12/5/24 No Longer in use==
Usage: Password never expires script running on tnwg01a-v0981
Account: SVC-UserAccess-CTRL
Delegates Read Write to user object “userAccountControl” parameter
==Delegation-DHSmail-OU==
Delegate permissions to CN=Deleted Objects
dsacls "CN=Deleted Objects,DC=ad,DC=cbp,DC=dhs,DC=gov" /takeownership
dsacls "CN=Deleted Objects,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "AD\Delegation-DHSmail-OU:LCRP"
Join Computer Objects / Create Computer objects /Move
PowerShell (tested 3/26/2020) run on both OU locations
#$user = 'AD\Delegation-WorkstationsSpecialPurpose-BEMS-ICAD'
#$ou = 'OU=ICAD SURVEILLANCE PROCESSORS,OU=BEMSD,OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
#$ou = 'OU=ADEX,OU=WSG,OU=EDMED,OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
#$user = 'AD\Delegation-Computer-Move-Pride'
#$ou = 'OU=PRIDE-RPM,OU=LSS,OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
#$ou = 'OU=ICAD,OU=BEMSD,OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
#$user = 'AD\Deligation-Computer-Join-ICAD'
#$ou= 'OU=ICAD,OU=BEMS,OU=Servers Field,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
#$ou='OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
DSACLS $ou /R $user
DSACLS $ou /I:S /G "$($user):GR;;computer"
DSACLS $ou /I:S /G "$($user):CC;computer"
DSACLS $ou /I:S /G "$($user):CA;Reset Password;computer"
DSACLS $ou /I:S /G "$($user):CA;Change Password;computer"
DSACLS $ou /I:S /G "$($user):CA;Validated write to service principal name;computer"
DSACLS $ou /I:S /G "$($user):WP;description;computer"
DSACLS $ou /I:S /G "$($user):WP;DNS Host Name Attributes;computer"
DSACLS $ou /I:S /G "$($user):WP;pwdLastSet;computer"
DSACLS $ou /I:S /G "$($user):WP;Logon Information;computer"
DSACLS $ou /I:S /G "$($user):WP;displayName;computer"
DSACLS $ou /I:S /G "$($user):WP;sAMAccountName;computer"
DSACLS $ou /I:S /G "$($user):WP;Account Restrictions;computer"
DSACLS $ou /I:S /G "$($user):WP;servicePrincipalName;computer"
Pride Workstations Description 4/15/2020
dsacls "OU=PRIDE-RPM,OU=LSS,OU=Workstations Special Purpose,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\Delegation-Computer-Description-Pride:WP;description;computer"
ICAD Privileged Accounts unlock 4/22/2020
$user = 'AD\Delegation-AccountsPrivileged-BEMSD-ICAD-UNLOCK'
$ou = 'OU=ICAD,OU=BEMS,OU=Accounts Privileged,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
DSACLS $ou /I:S /G "$($user):CA;Reset Password;user"
ICAD CommonUsers Accounts unlock 6/18/2020 must be run with -0 account
$user = 'AD\Delegation-CommonUser-ICAD-Unlock'
$ou = 'OU=ICAD,OU=BEMSD,OU=Accounts Common,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov'
DSACLS $ou /I:S /G "$($user):CA;Reset Password;user"
ICAM extensionAttribute14 rights to Server Access Groups. 8/10/2022
SG-Delegation-Server Access-extensionAttribute14
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;==group==" /I:S
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;user" /I:S
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;==group==" /I:S
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;user" /I:S
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;==group==" /I:S
DSACLS "OU=SERVER ACCESS,OU=Groups Security,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-Server Access-extensionAttribute14:RPWP;extensionAttribute14;user" /I:S
DMZ Delegations extensionAttribute14 and extensionAttribute13 8/30/2023
DSACLS "OU=Groups Security,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "Delegation-SecurityGroups-extensionAttribute14:RPWP;extensionAttribute14;group" /I:S
DSACLS "OU=Groups Security,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "Delegation-SecurityGroups-extensionAttribute13:RPWP;extensionAttribute13;group" /I:S
DSACLS "OU=GROUPS-ICAM MANAGED,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "Delegation-SecurityGroups-extensionAttribute14:RPWP;extensionAttribute14;group" /I:S
DSACLS "OU=GROUPS-ICAM MANAGED,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /G "Delegation-SecurityGroups-extensionAttribute13:RPWP;extensionAttribute13;group" /I:S
Cluster identity can update computer objects in the domain==.== 11/8/2022
==Reset Password==
==Validated Write to DNS Host Name==
==Validated Write to Service Principal Name==
> From <https://learn.microsoft.com/en-us/answers/questions/120834/the-computer-object-associated-with-the-cluster-ne.html>
SAT OU=Accounts Privileged 1/22/2025
SAT domain delegate rights for SailPoint team to create/enable/disable reset password on User accounts
dsacls "OU=Accounts Privileged,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Accounts-Privileged-ICAM_MANAGED:GA;userAccountControl;user" /I:S
dsacls "OU=Accounts Privileged,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Accounts-Privileged-ICAM_MANAGED:GA;user" /I:T
$user = 'SAT\Delegation-Accounts-Privileged-ICAM_MANAGED'
$ou = 'OU=Accounts Privileged,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov'
DSACLS $ou /I:S /G "$($user):CA;Reset Password;user"
dsacls "OU=Accounts Privileged,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Accounts-Privileged-ICAM_MANAGED:CC;user" /I:S
SAT OU=Development 1/22/2025
SAT domain delegate rights for SailPoint team to create/enable/disable reset password Users accounts
dsacls "OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Development-ICAM_MANAGED:GA;user" /I:S
dsacls "OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Development-ICAM_MANAGED:GA;user" /I:T
$user = 'SAT\Delegation-Development-ICAM_MANAGED'
dsacls "OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-Development-ICAM_MANAGED:WP;userAccountControl;user" /I:S
$ou = 'OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov'
DSACLS $ou /I:S /G "$($user):CA;Reset Password;user"
SAT OU=Development 1/23/2025
SAT OU Create/delete SailPoint team
dsacls "OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-OU-Development:CC;organizationalUnit" /I:T
dsacls "OU=Development,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /G "SAT\Delegation-OU-Development:DC;organizationalUnit" /I:T
Example:
Cluster service Name TNWG01A-C0398$
Cluster Nodes TNWG01A-V4273, TNWG01A-V4274
$ClusterServiceAccount = 'AD\TNWG01A-C0398$'
$Cmember1 = 'CN=TNWG01A-V4273,OU=RC4-DEP,OU=SQL-SERVERS,OU=SQL,OU=EDME,OU=PreProduction,DC=ad,DC=cbp,DC=dhs,DC=gov'
$Cmember2 = 'CN=TNWG01A-V4274,OU=RC4-DEP,OU=SQL-SERVERS,OU=SQL,OU=EDME,OU=PreProduction,DC=ad,DC=cbp,DC=dhs,DC=gov'
DSACLS $Cmember1 /I:S /G "$($ClusterServiceAccount):CA;Reset Password;computer"
DSACLS $Cmember1 /I:S /G "$($ClusterServiceAccount):CA;Validated write to service principal name;computer"
DSACLS $Cmember1 /I:S /G "$($ClusterServiceAccount):WP;DNS Host Name Attributes;computer"
DSACLS $Cmember2 /I:S /G "$($ClusterServiceAccount):CA;Reset Password;computer"
DSACLS $Cmember2 /I:S /G "$($ClusterServiceAccount):CA;Validated write to service principal name;computer"
DSACLS $Cmember2 /I:S /G "$($ClusterServiceAccount):WP;DNS Host Name Attributes;computer"
Delegation Create/delete Organizational units ==created 12/4/2024==
Define the user or group and the OU path
$userOrGroup = "SAT\Delegation-OU-Development" # Replace with your user or group
$ouPath = "OU=MyTest,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" # Replace with your OU path
Import the Active Directory module
Import-Module ActiveDirectory
Import the required .NET namespace
Add-Type -AssemblyName System.DirectoryServices
Get the distinguished name (DN) of the OU
$ou = Get-ADOrganizationalUnit -Identity $ouPath
Define the ObjectType GUID for Organizational Unit
$organizationalUnitGuid = [Guid]::Parse("bf967aa5-0de6-11d0-a285-00aa003049e2")
Define permissions for creating and deleting Organizational Units
$createPermission = [System.DirectoryServices.ActiveDirectoryRights]::CreateChild
$deletePermission = [System.DirectoryServices.ActiveDirectoryRights]::DeleteChild
Create the access rules
$createAce = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
[System.Security.Principal.NTAccount]$userOrGroup,
$createPermission,
[System.Security.AccessControl.AccessControlType]::Allow,
$organizationalUnitGuid,
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::All
)
$deleteAce = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
[System.Security.Principal.NTAccount]$userOrGroup,
$deletePermission,
[System.Security.AccessControl.AccessControlType]::Allow,
$organizationalUnitGuid,
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::All
)
Get the security descriptor of the parent OU
$securityDescriptor = Get-Acl -Path "AD:$($ou.DistinguishedName)"
Add the access rules to the security descriptor
$securityDescriptor.AddAccessRule($createAce)
$securityDescriptor.AddAccessRule($deleteAce)
Set the updated security descriptor on the parent OU
Set-ACL -Path "AD:$($ou.DistinguishedName)" -AclObject $securityDescriptor
Verify if the permissions have been added
$updatedSecurityDescriptor = Get-Acl -Path "AD:$($ou.DistinguishedName)"
$updatedAccessRules = $updatedSecurityDescriptor.Access | Where-Object { $_.IdentityReference -eq $userOrGroup }
if ($updatedAccessRules) {
Write-Host "Permissions to create and delete Organizational Units have been successfully granted to $userOrGroup on $($ou.DistinguishedName)"
$updatedAccessRules | Format-Table -AutoSize
} else {
Write-Host "Failed to verify the delegation. Permissions may not have been applied correctly." -ForegroundColor Red
}
Delegation Of Group Management
Delegation Create/delete Groups ==created 12/4/2024==
Import the Active Directory module
Import-Module ActiveDirectory
Import the required .NET namespace
Add-Type -AssemblyName System.DirectoryServices
Define the user or group and the OU path
$userOrGroup = "SAT\Delegation-Development-GROUPS-ICAM_MANAGED" # Replace with your user or group
$ouPath = "OU=MyTest,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" # Replace with your OU path
Get the distinguished name (DN) of the OU
$ou = Get-ADOrganizationalUnit -Identity $ouPath
Define the ObjectType GUID for Group objects
$groupGuid = [Guid]::Parse("bf967a9c-0de6-11d0-a285-00aa003049e2")
Define permissions for creating and deleting Group objects
$createPermission = [System.DirectoryServices.ActiveDirectoryRights]::CreateChild
$deletePermission = [System.DirectoryServices.ActiveDirectoryRights]::DeleteChild
Create the access rules
$createAce = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
[System.Security.Principal.NTAccount]$userOrGroup,
$createPermission,
[System.Security.AccessControl.AccessControlType]::Allow,
$groupGuid,
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::All
)
$deleteAce = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
[System.Security.Principal.NTAccount]$userOrGroup,
$deletePermission,
[System.Security.AccessControl.AccessControlType]::Allow,
$groupGuid,
[System.DirectoryServices.ActiveDirectorySecurityInheritance]::All
)
Get the security descriptor of the parent OU
$securityDescriptor = Get-Acl -Path "AD:$($ou.DistinguishedName)"
Add the access rules to the security descriptor
$securityDescriptor.AddAccessRule($createAce)
$securityDescriptor.AddAccessRule($deleteAce)
Set the updated security descriptor on the parent OU
Set-ACL -Path "AD:$($ou.DistinguishedName)" -AclObject $securityDescriptor
Verify if the permissions have been added
$updatedSecurityDescriptor = Get-Acl -Path "AD:$($ou.DistinguishedName)"
$updatedAccessRules = $updatedSecurityDescriptor.Access | Where-Object { $_.IdentityReference -eq $userOrGroup }
if ($updatedAccessRules) {
Write-Host "Permissions to create and delete Group objects have been successfully granted to $userOrGroup on $($ou.DistinguishedName)"
$updatedAccessRules | format-Table -AutoSize
} else {
write-host "Failed to verify the delegation. Permission may not have been applied correctly." -ForegroundColor Red
}
gMSA Accounts delegation to create SPN
SAT
dsacls "OU=SQL,OU=EDME,OU=Accounts Group Managed System,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /I:S /G "SAT\SG-SQL-INSTANCEADMINS:RPWP;servicePrincipalName"
AD
dsacls "OU=SQL,OU=EDME,OU=Accounts Group Managed System,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\SG-SQL-INSTANCEADMINS:RPWP;servicePrincipalName"
dsacls "OU=SQL,OU=EIOD,OU=Accounts Group Managed System,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" /I:S /G "AD\SG-SQL-INSTANCEADMINS:RPWP;servicePrincipalName"
DMZ
dsacls "OU=SQL,OU=EIOD,OU=Account Group Managed System,OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /I:S /G "DMZ\SG-SQL-OSADMINS:RPWP;servicePrincipalName"
SAT allow
“this account supports Kerberos AES 256 bit encryption”
dsacls "OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /I:S /G "SAT\Delegation-User-msDS-SupportedEncryptionTypes:RPWP;msDS-SupportedEncryptionTypes"
dsacls "OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /I:S /G "SAT\SVC-WSG-ORCH-USRMNT:RPWP;msDS-SupportedEncryptionTypes"
DMZ allow
“this account supports Kerberos AES 256 bit encryption”
dsacls "OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /I:S /G "DMZ\Delegation-User-msDS-SupportedEncryptionTypes:RPWP;msDS-SupportedEncryptionTypes"
dsacls "OU=AccessControl,DC=dmz,DC=cbp,DC=dhs,DC=gov" /I:S /G "DMZ\SVC-WSG-ORCH-USRMNT:RPWP;msDS-SupportedEncryptionTypes"
LAPS (ms-Mcs-AdmPwd read)
#Install-Module -Name AdmPwd.PS ==# one time install==
Import-Module AdmPwd.PS
Set-AdmPwdReadPasswordPermission –Identity "OU=Production,DC=ad,DC=cbp,DC=dhs,DC=gov" –AllowedPrincipals "Delegation-Computer-ms-Mcs-AdmPwd"
Set-AdmPwdReadPasswordPermission –Identity "OU=PreProduction,DC=ad,DC=cbp,DC=dhs,DC=gov" –AllowedPrincipals "Delegation-Computer-ms-Mcs-AdmPwd"
Set-AdmPwdReadPasswordPermission –Identity "OU=Servers Field,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" –AllowedPrincipals "Delegation-Computer-ms-Mcs-AdmPwd"
==Review is LAPS is set==
Get-ADComputer -SearchBase "OU=Servers Field,OU=AccessControl,DC=ad,DC=cbp,DC=dhs,DC=gov" -Filter {ms-Mcs-AdmPwd -notlike ""} | Where-Object { $_.Name -notlike "-C*" }
Get-ADComputer -SearchBase "OU=PreProduction,DC=ad,DC=cbp,DC=dhs,DC=gov" -Filter {ms-Mcs-AdmPwd -notlike ""} | Where-Object { $_.Name -notlike "-C*" }
Get-ADComputer -SearchBase "OU=Production,DC=ad,DC=cbp,DC=dhs,DC=gov" -Filter {ms-Mcs-AdmPwd -notlike ""} | Where-Object { $_.Name -notlike "-C*" }
Delegation of User Account Management 10/4/2024
Delegation setting for any Users account management.
Example: Delegation-Leave-Of-Absence-Users and Delegation-Account-Special-Purpose-Users
$OULocation = "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov"
$SecurityGroup = "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP"
#Setup User management
dsacls "$OULocation" /I:S /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP":GA
#Setup Group management
dsacls "$OULocation" /I:S /G "DomainName\GroupName":CCDCRP;group
#Setup OU management
dsacls "$OULocation" /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:CCDC;OU" /I:S
dsacls "$OULocation" /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:RP;group" /I:S
dsacls "$OULocation" /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:RPWP;displayName;user" /I:S
dsacls "$OULocation" /I:S /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP":RP;group
dsacls "$OULocation" /G "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:CCDC;group" /I:S
DSACLS "DC=ad,DC=cbp,DC=dhs,DC=gov" /G "SG-Delegation-User-Attributes:RPWP;L;user" /I:S
dsacls "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /I:S /G "SAT\Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:WPRPCA;OU"
dsacls "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov" /I:S /G "SAT\Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP:CCDC;organizational unit"
$ou = "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov"
$group = "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP"
Get the security group object
$securityGroup = Get-ADGroup $group
Grant permissions to the security group on the OU
Add-ADPermission -Identity $ou -User $securityGroup.Name -AccessRights CreateChild, DeleteChild -InheritanceType All -ObjectType "OrganizationalUnit"
$OrganizationalUnit = "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov"
$GroupName = "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP"
Set-Location AD:
$Group = Get-ADGroup -Identity $GroupName
$GroupSID = [System.Security.Principal.SecurityIdentifier] $Group.SID
$ACL = Get-Acl -Path $OrganizationalUnit
$Identity = [System.Security.Principal.IdentityReference] $GroupSID
$ADRight = [System.DirectoryServices.ActiveDirectoryRights] "CreateChild, DeleteChild"
$Type = [System.Security.AccessControl.AccessControlType] "Allow"
$InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] "None"
$ObjectType = [System.Guid]::Empty
$InheritedObjectType = [System.Guid]::Empty
$Rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, $ADRight, $Type, $ObjectType, $InheritedObjectType)
$ACL.AddAccessRule($Rule)
Set-Acl -Path $OrganizationalUnit -AclObject $ACL
$OrganizationalUnit = "OU=GROUPS-DMZ ICAM MANAGED MOCKUP,OU=AccessControl,DC=sat,DC=cbp,DC=dhs,DC=gov"
$ServiceUserName = "Delegation-GROUPS-DMZ ICAM MANAGED MOCKUP"
Set-Location AD:
$Group = Get-ADGroup -Identity $ServiceUserName
$GroupSID = [System.Security.Principal.SecurityIdentifier] $Group.SID
$ACL = Get-Acl -Path $OrganizationalUnit
$Identity = [System.Security.Principal.IdentityReference] $GroupSID
$Computers = [GUID]"bf967a86-0de6-11d0-a285-00aa003049e2"
$ResetPassword = [GUID]"00299570-246d-11d0-a768-00aa006e0529"
$ValidatedDNSHostName = [GUID]"72e39547-7b18-11d1-adef-00c04fd8d5cd"
$ValidatedSPN = [GUID]"f3a64788-5306-11d1-a9c5-0000f80367c1"
$AccountRestrictions = [GUID]"4c164200-20c0-11d0-a768-00aa006e0529"
$guidChangePassword = [GUID]"ab721a53-1e2f-11d0-9819-00aa0040529b"
$guidLockoutTime = [GUID]"28630ebf-41d5-11d1-a9c1-0000f80367c1"
#$guidPwdLastSet = [GUID]"bf967a0a-0de6-11d0-a285-00aa003049e2"
#$guidComputerObject = [GUID]"bf967a86-0de6-11d0-a285-00aa003049e2"
#$guidUserObject = [GUID]"bf967aba-0de6-11d0-a285-00aa003049e2"
$guidLinkGroupPolicy = [GUID]"f30e3bbe-9ff0-11d1-b603-0000f80367c1"
$guidGroupPolicyOptions = [GUID]"f30e3bbf-9ff0-11d1-b603-0000f80367c1"
$guidResetPassword = [GUID]"00299570-246d-11d0-a768-00aa006e0529"
$guidGroupObject = [GUID]"Guid BF967A9C-0DE6-11D0-A285-00AA003049E2"
$guidContactObject = [GUID]"5CB41ED0-0E4C-11D0-A286-00AA003049E2"
$guidOUObject = [GUID]"BF967AA5-0DE6-11D0-A285-00AA003049E2"
$guidPrinterObject = [GUID]"BF967AA8-0DE6-11D0-A285-00AA003049E2"
$guidWriteMembers = [GUID]"bf9679c0-0de6-11d0-a285-00aa003049e2"
$guidNull = [GUID]"00000000-0000-0000-0000-000000000000"
$guidPublicInformation = [GUID]"e48d0154-bcf8-11d1-8702-00c04fb96050"
$guidGeneralInformation = [GUID]"59ba2f42-79a2-11d0-9020-00c04fc2d3cf"
$guidPersonalInformation = [GUID]"77B5B886-944A-11d1-AEBD-0000F80367C1"
$guidGroupMembership = [GUID]"bc0ac240-79a9-11d0-9020-00c04fc2d4cf"
#$RuleCreateAndDeleteGroup = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, "CreateChild, DeleteChild", "Allow", $guidGroupObject, "All")
$RuleCreateAndDeleteComputer = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, "CreateChild, DeleteChild", "Allow", $Computers, "All")
$RuleResetPassword = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($Identity, "ExtendedRight", "Allow", $ResetPassword, "Descendents", $Computers)
$RuleValidatedDNSHostName = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($GroupSID, "Self", "Allow", $ValidatedDNSHostName, "Descendents", $Computers)
$RuleValidatedSPN = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($GroupSID, "Self", "Allow", $ValidatedSPN, "Descendents", $Computers)
$RuleAccountRestrictions = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($Identity, "ReadProperty, WriteProperty", "Allow", $AccountRestrictions, "Descendents", $Computers)
#$ACL.AddAccessRule($RuleCreateAndDeleteGroup)
$ACL.AddAccessRule($RuleCreateAndDeleteComputer)
$ACL.AddAccessRule($RuleResetPassword)
$ACL.AddAccessRule($RuleValidatedDNSHostName)
$ACL.AddAccessRule($RuleValidatedSPN)
$ACL.AddAccessRule($RuleAccountRestrictions)
Set-Acl -Path $OrganizationalUnit -AclObject $ACL
Computer Rename delegation
Import the Active Directory module
Import-Module ActiveDirectory
Define variables
$domain = "DC=ad,DC=cbp,DC=dhs,DC=gov" #
$delegatedGroup = "SG-WSG-RenameWRKST" # Group to receive the permissions
$ouPath = "OU=TestPermission,OU=WSG Workstations,OU=NWG001A,OU=NOVA,OU=NationalCapital,DC=ad,DC=cbp,DC=dhs,DC=gov" # Target OU where delegation will apply
Get the group object
$group = Get-ADGroup $delegatedGroup
Construct the DSACLS command to delegate the "Write Property" permission for the "Name" attribute
$dsaclsCommand = "dsacls.exe "$ouPath" /I:S /G "$($group.SamAccountName):WP;Name;computer""
Execute the DSACLS command
Invoke-Expression $dsaclsCommand
Write-Host "Delegation rights to rename computer objects in $ouPath have been granted to $delegatedGroup"