☰

将 OU 权限从现有安全组复制到新安全组

tag-icon • tag-icon active-directory windows
将 OU 权限从现有安全组复制到新安全组

目前，我们有一个名为：Limited_IT_Admins 的安全组，该组对国家 OU 内的约 7 个城市 OU 具有特殊权限（仅限于他们可以执行的某些任务）。

[Country] <- top level OU
  [City01]
  [City02]
  [City03]
  [City04]
  [City05]
  [City06]
  [City07]

但是，现在我必须将这个单一安全组拆分成三个单独的组。Limited_IT_Admin 组中的用户将被拆分成三个独立的新组。这些用户需要与 Limited_IT_Admins 相同的访问权限，但只能在其各自的 OU 上访问。

Limited_IT_Admin_01 - User01
  City01, City02, City03

Limited_IT_Admin_02 - User02
  City04, City05

Limited_IT_Admin_03 - User03
   City06, City07

而不必尝试重新创建在安全组上设置的所有特殊权限，有没有更简单的方法将 Limited_IT_Admins 的权限复制到三个新组？

答案1

我创建了一个 Powershell 函数Copy-DsAcl这将有助于执行此类 Active Directory 权限复制。使用此功能，原始答案（行下）可以更清晰地重写为：

 Import-Module ActiveDirectory

 # Dot source the Copy-DsAcl function: https://github.com/jasonkeithscott/Copy-DsAcl
 . .\Copy-DsAcl.ps1

 # Reference objects
 $sourceGroup    = Get-ADGroup Limited_IT_Admins
 $sourceObject   = Get-ADOrganizationalUnit -Filter { Name -eq "City01" }

 # Hash for the new groups and their assigned OUs
 $targetGroups   = @{}
 $targetGroups.Add("Limited_IT_Admin_01", @("City01", "City02", "City03"))
 $targetGroups.Add("Limited_IT_Admin_02", @("City04", "City05"))
 $targetGroups.Add("Limited_IT_Admin_03", @("City06", "City07"))

 # Walk each targetGroup in the hash
 foreach ( $g in $targetGroups.GetEnumerator() ) {

     $targetGroup = Get-ADGroup $g.Name

     # Walk each $city OU and add the $targetGroup to the ACL
     foreach ( $city in $g.Value ) {

         Write-Host "Adding $($g.Name) to $city"
         $targetObject = Get-ADOrganizationalUnit -Filter { Name -eq $city }
         Copy-DsAcl $sourceGroup $sourceObject $targetGroup $targetObject

     }

 }

下面的 Powershell 应该可以满足您的要求。有几个要求：

  1. 您需要 Microsoft ActiveDirectory Powershell 模块。它包含在 RSAT7 中。
  2. 您需要根据您的环境更新以下内容：
    1. $root- 将 PSDrive 添加到您的“根”OU。问题中的“国家”。
    2. $sourceOU- 您将从中复制 ACE 的源 OU（名称，而不是 DN）。
    3. $sourceGroup- 您将复制的 ACL 中列出的组（名称，而不是 DN 或域）。
    4. $targetGroups- 用于应用 ACE 的组 (名称，不是 DN 或域) 和 OU (名称，不是 DN) 的哈希值。
  3. 这只会复制显式 ACE，而不会复制继承的 ACE。也许我应该看看树上的内容来获取继承的 ACE？
  4. 我必须以域管理员身份运行此程序，因为我收到“拒绝访问”错误。但我最初的 OU 委派可能存在问题。

读完这些内容后，我想我应该写一个更通用的函数，CopyOuAcl并在完成后更新它。正如现在所写的那样，它完全针对您的问题和环境。

Import-Module ActiveDirectory

$root          = "AD:\OU=Country,DC=example,DC=com"
$sourceOU       = "City01"
$sourceACL      = Get-Acl $root.Replace("AD:\", "AD:\OU=$sourceOU,")
$sourceGroup    = "Limited_IT_Admins"

# Hash for the new groups and their OUs
$targetGroups = @{}
$targetGroups.Add("Limited_IT_Admin_01", @("City01", "City02", "City03"))
$targetGroups.Add("Limited_IT_Admin_02", @("City04", "City05"))
$targetGroups.Add("Limited_IT_Admin_03", @("City06", "City07"))

# Get the uniherited ACEs for the $sourceGroup from $sourceOU
$sourceACEs = $sourceACL |
    Select-Object -ExpandProperty Access |
        Where-Object { $_.IdentityReference -match "$($sourceGroup)$" -and $_.IsInherited -eq $False }

# Walk each targetGroup in the hash
foreach ( $g in $targetGroups.GetEnumerator() ) {

    # Get the AD object for the targetGroup
    Write-Output $g.Name
    $group      = Get-ADGroup $g.Name
    $identity   = New-Object System.Security.Principal.SecurityIdentifier $group.SID

    # Could be multiple ACEs for the sourceGroup
    foreach ( $a in $sourceACEs ) {

        # From from the sourceACE for the ActiveDirectoryAccessRule constructor  
        $adRights               = $a.ActiveDirectoryRights
        $type                   = $a.AccessControlType
        $objectType             = New-Object Guid $a.ObjectType
        $inheritanceType        = $a.InheritanceType
        $inheritedObjectType    = New-Object Guid $a.InheritedObjectType

        # Create the new "copy" of the ACE using the target group. http://msdn.microsoft.com/en-us/library/w72e8e69.aspx
        $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $identity, $adRights, $type, $objectType, $inheritanceType, $inheritedObjectType    

        # Walk each city OU of the target group
        foreach ( $city in $g.Value ) {

            Write-Output "`t$city"
            # Set the $cityOU
            $cityOU = $root.Replace("AD:\", "AD:\OU=$city,")
            # Get the ACL for $cityOU
            $cityACL = Get-ACL $cityOU
            # Add it to the ACL
            $cityACL.AddAccessRule($ace)
            # Set the ACL back to the OU
            Set-ACL -AclObject $cityACL $cityOU

        }

    }

}

答案2

http://gallery.technet.microsoft.com/scriptcenter/Copying-permissions-for-d3c3b839

或者只复制 NtSecurityDescriptor。http://blogs.msdn.com/spatdsg/archive/2007/05/24/copying-delegation-permissions-from-an-ou-to-another.aspx

相关内容