Modify ACL's on an AD OU

i have been banging head against desk days trying figure out how modify acl’s on ou using native cmdlets powershell.  i have been avoiding dsacls , quest cmdlets.

i can ace want reset can’t figure out.  thoughts?  ### reset permissions code goes , don’t know of correct cmd.

it function want able call passing of path of ou, security principal , permission grant.  right have fixed permission within function itself.

##################################################################
## check on ou , verify acl's set on ou  ##
##################################################################
function updateouacl($oupath, $principalid) 
{
$ouexist = test-path ad:$oupath        # verify ou given exists
if ($ouexist)
   {$childous = get-adorganizationalunit -searchbase $oupath -filter * -searchscope base 

   ## identity - $acldn.identityreference -eq domain name\identity principal
      
    foreach ($childou in $childous) 
        {$dn = $childou.distinguishedname
         $cntr=0
         set-location ad:
         $aclsdn = (get-acl $dn).access                                   # http://technet.microsoft.com/en-us/library/dd378932(v=ws.10).aspx

         write-host "ou being processed $dn"                           # list out ou acl's being dumped from
         foreach($acldn in $aclsdn)
            {$cntr++
             write-host "acl number - " $cntr
             $acldnid = $acldn.identityreference
             if($acldnid -eq $principalid)
               {write-host "$acldnid identity found"
                if(($acldn.accesscontroltype -eq "allow") -and ($acldn.inheritancetype -eq "none") -and (!($acldn.activedirectoryrights -eq "genericread")))
                   {

### reset permissions
                                     
                   }                                 # end change permission
                }                                    # end security principal found
               }                                     # end traverse acl's
            }                                        # end ou traversal
        }                                            # end if ou exists test
     
else { write-host " "
       write-host "the path $oupath not exist" -foreground "red"
     }                                               # end error message missing ou
}                                                    # end function
  

hi,

thank question.

i trying involve familiar topic further @ issue. there might time delay. appreciate patience.

thank understanding , support.

regards，

yan li

if have feedback on our support, please click here .

---

cataleya li
technet community support

Windows Server  >  Windows PowerShell