Hallo!
Due to the help in this Newgroups I am now able to set basic rights to a
Computer account in active directory.
The following c#-Code works fine
-----------------------------------------------------
using System.Security.Principal;
using System.DirectoryServices;
string strMemberString = "LDAP://OU=Test,DC=Domainname,DC=local";
DirectoryEntry computers = new DirectoryEntry();
computers.Path = strMemberString;
computers.Options.SecurityMasks = SecurityMasks.Owner | SecurityMasks.Group
| SecurityMasks.Dacl | SecurityMasks.Sacl;
foreach (DirectoryEntry computer in computers.Children)
{
if (computer.Name == "CN=TestComp")
{
ActiveDirectorySecurity sdc = computer.ObjectSecurity;
NTAccount Account = new NTAccount("Domainname\\XYZ");
SecurityIdentifier Sid =
(SecurityIdentifier)Account.Translate(typeof(Secur ityIdentifier));
ActiveDirectoryAccessRule rule = new ActiveDirectoryAccessRule(Sid,
ActiveDirectoryRights.ExtendedRight | ActiveDirectoryRights.GenericRead,
AccessControlType.Allow);
sdc.SetAccessRule(rule);
computer.CommitChanges();
}
}
-------------------------------------------------------
My job is to create a computer account for a managed Computer account for
installing the computer with RIS.
The final ACL of the computer account should be exactly the same as when
creating the account via "AD-Users and Computers" tool.
If I setup a managed Computer account via AD-Users and Computers the ACL
shows the following rights for the destinated User:
- Allow "List Contents"
- Allow "Read All Property"
- Allow "Delete"
- Allow "Detete Subtree"
- Allow "Read Permissions"
- Allow "All Extended Rights"
- Allow "Allow to authenticate"
- Allow "Change Password"
- Allow "Receive as"
- Allow "Reset Password"
- Allow "Send as"
- Allow "Write Account Restrictions"
- Allow "Validate write to DNS-Hostname"
- Allow "Validate Write to service prinzipal name"
- Allow "Write Computer name (pre Windows 2000)
Most of this rights are listet in the extended rights list in
MSDN-documentation
(http://msdn.microsoft.com/library/de...ed_rights.asp).
How can I set these extended rights? Is it possible to extend the code above
to do this job?
Thanks for help!
