Change permissions on Active Directory objects

All objects in Active Directory have their own ACL. In some cases it’s necessary to change the ACL on or multiple objects. Their are as always different ways of doing this. I will show you two ways in which you can change the rights on a AD object. First we’ll take a look at the tool DSACLS.EXE. After that I’ll show you the “click”-way to get this job done.

The first time I needed this tool was when I came across an object, in this case a group, which had an explicit Deny for Everyone. I found that it was the Active Directory Connector which, by design, added the Everyone group with an explicit deny. In this case I saw that I was unable to edit the security settings with the MMC. Ofcourse I didn’t have to change the security settings, but it got me thinking. If in a bizar “click”-accident somebody added the Everyone group with a deny to an object, how would you remove that?

After a little search I came across DSACLS. This Microsoft tool, which is included in the Windows Support Tools, is a good tool to manage the ACL’s for objects. Because it’s a command-line based tool you are able to use this in batch scripts.

You can also change permissions in Active Directory through the Microsoft Management Console. I will give you one example on how to remove the Everyone group from a specific object. Be sure if you want to run this command you first create a test object (or better a test Active Directory). Let’s assume we have a group named “Test Group” in an OU called “Test OU”. Everyone has an explicit deny and we want to remove this from the ACL. Type the following in a command prompt:

dsacls “CN=Test Group,OU=Test OU,DC=domain,DC=com” /R Everyone

Be sure to put the CN name of the object between “”. This will do the trick even if you have spaces in the CN.

Is that all? Well actually yes. There are many more commands and options, so I have added the the full command list of DSACLS below.

Now for changing permissions through the MMC. Open the Active Directory Users and Computers MMC and on the View menu, select Advanced Feature. Now you will see more containers.
Go to the AD object you wish to change the ACL permissions. Right click on the object and select properties. Select the security tab and to view all settings click on Advanced.
Here you can grant or deny permissions for your objects.

Total command list of DSACLS:

DSACLS object [/I:TSP] [/N] [/P:YN] [/G : [...]]
[/R [...]] [/D : [...]]
[/S] [/T] [/A]
object Path to the AD object for which to display or
manipulate the ACLs
Path is the RFC 1779 format of the name, as in
CN=John Doe,OU=Software,OU=Engineering,DC=Widget,DC=com
A specific Active Directory can be denoted by prepending \\server\
to the object, as in
\\ADSERVER\CN=John Doe,OU=Software,OU=Engineering,DC=Widget,DC=US

no options displays the security on the object.
/IInheritance flags:
T: This object and sub objects
S: Sub objects only
P: Propagate inheritable permissions one level only.
/NReplaces the current access on the object, instead of
editing it.
/PMark the object as protected
Y:Yes
N:No
If /P option is not present, current protection flag is
maintained.
/G :
Grant specified group (or user) specified permissions.
See below for format of and
/D :
Deny specified group (or user) specified permissions.
See below for format of and
/R Remove all permissions for the specified group (or user).
See below for format of
/SRestore the security on the object to the default for
that object class as defined in AD Schema.
/TRestore the security on the tree of objects to the
default for the object class.
This switch is valid only with the /S option.
/AWhen displaying the security on an Active Directory object,
display the ownership and auditing information as well as
the permissions
should be in the following forms:
group@domain or domain\group
user@domain or domain\user
should be in the following form:
[Permission bits];[Object/Property];[Inherited Object Type]
Permission bits can have the following values concatenated together:
Generic Permissions
GRGeneric Read
GEGeneric Execute
GWGeneric Write
GAGeneric All
Specific Permissions
SDDelete
DTDelete an object and all of it’s children
RCRead security information
WDChange security information
WOChange owner information
LCList the children of an object
CCCreate child object
DCDelete a child object
For these two permissions, if [Object/Property] is
not specified to define a specific child object type,
they apply all types of child objects otherwise they
apply to that specific child object type.
WSWrite to self object
Meaningful only on Group objects and when [Object/Property]
is filled in as “member”
WPWrite property
RPRead property
For these two permissions, if [Object/Property] is not
specified to define a specific property, they apply to
all properties of the object otherwise they apply to that
specific property of the object.
CAControl access right
For this permission, if [Object/Property] is not specified
to define the specific “extended right” for control access,
it applies to all control accesses meaningful on the
object, otherwise it applies to the specific extended right
for that object.
LOList the object access. Can be used to grant
list access to a specific object if
List Children (LC) is not granted to the parent as
well can denied on specific objects to hide those objects
if the user/group has LC on the parent.
NOTE: Active Directory does NOT enforce this permission
by default, it has to be configured to start checking for
this permission.
[Object/Property]
must be the display name of the object type or the property.
for example “user” is the display name for user objects and
“telephone number” is the display name for telephone number property.
[Inherited Object Type]
must be the display name of the object type that the permissions
are expected to be inherited to. The permissions MUST be Inherit Only.
NOTE: This must only be used when defining object specific permissions
that override the default permissions defined in the AD schema for that
object type. USE THIS WITH CAUTION and ONLY IF YOU UNDERSTAND object
specific permissions.
Examples of a valid would be:
SDRCWDWO;;user
means:
Delete, Read security information, Change security information and
Change ownership permissions on objects of type “user”.
CCDC;group;
means:
Create child and Delete child permissions to create/delete objects
of type group.
RPWP;telephonenumber;
means:
read property and write property permissions on telephone number
property
You can specify more than one user in a command.

For more information : How to Use Dsacls.exe in Windows Server 2003 and Windows 2000

Comments

Post a comment