Scripting: Security Role - Enumerate and change assignments

Question

I need to replace one Active Directory security group that has been given rights over many OUs within several Security Roles. There are likely ~300 entries that need to be updated.

I am looking for some advice on how to handle the following task via PowerShell:

On a Security Role, enumerate each assignment of a Trustee over an object, if the Trustee is a specific group then delete the entry and add a new entry for a different Trustee over the same object.

My primary problem is that I cannot seem to enumerate the values for Trustee and objects.

Any advice would be appreciated.

Thank you.

EDIT: FYI the link to the script repository that is referenced in the SDK documentation appears to be broken - http://adaxes.com/scriptrepository

Answer 1

Hello,

1. To get a list of role assignments, you need to use the Assignments property of the role object. You can use the IAdmCollection interface to enumerate all assignments.

2. Each assignment object implements the IAdmRoleAssignment and IADs interfaces. To get the SID of the trustee, you can use the IADs::Get method:

    $trusteeSidBytes = $role.Assignments.GetObject($i).Get("adm-TrusteeSid")
    $sid = New-Object System.Security.Principal.SecurityIdentifier($trusteeSidBytes, 0)
   

   Then you can compare the SID of the trustee with the SID of your group. Or you can bind to the trustee, get its distinguished name (DN), and then compare DNs.

    $trustee = $Context.BindToObject("Adaxes://<SID=$sid>")
    $trusteeDN = $trustee.Get("distinguishedName")
   

For more details, please see Managing Security Roles.