将 OU 权限从现有安全组复制到新安全组

Question

目前，我们有一个名为 Limited_IT_Admins 的安全组，它对 Country OU 内的 ~7 个城市 OU 具有特殊权限（仅限于他们可以执行的某些任务）。

[Country] <- top level OU
  [City01]
  [City02]
  [City03]
  [City04]
  [City05]
  [City06]
  [City07]

但是，现在我必须将这个单一的安全组分成三个单独的组。Limited_IT_Admin 组的用户将被分成三个独立的新组。用户将需要与 Limited_IT_Admins 相同的访问权限，但仅限于他们各自的 OU。

Limited_IT_Admin_01 - User01
  City01, City02, City03

Limited_IT_Admin_02 - User02
  City04, City05

Limited_IT_Admin_03 - User03
   City06, City07

不必尝试重新创建在安全组上设置的所有特殊权限，是否有任何更简单的方法可以将 Limited_IT_Admins 拥有的权限复制到三个新组？

Answer 1

我创建了一个 Powershell 函数Copy-DsAcl，它应该有助于执行这种 Active Directory 权限复制。使用此函数，原始答案（行下方）可以更清晰地重写为：

 Import-Module ActiveDirectory

 # Dot source the Copy-DsAcl function: https://github.com/jasonkeithscott/Copy-DsAcl
 . .\Copy-DsAcl.ps1

 # Reference objects
 $sourceGroup    = Get-ADGroup Limited_IT_Admins
 $sourceObject   = Get-ADOrganizationalUnit -Filter { Name -eq "City01" }

 # Hash for the new groups and their assigned OUs
 $targetGroups   = @{}
 $targetGroups.Add("Limited_IT_Admin_01", @("City01", "City02", "City03"))
 $targetGroups.Add("Limited_IT_Admin_02", @("City04", "City05"))
 $targetGroups.Add("Limited_IT_Admin_03", @("City06", "City07"))

 # Walk each targetGroup in the hash
 foreach ( $g in $targetGroups.GetEnumerator() ) {

     $targetGroup = Get-ADGroup $g.Name

     # Walk each $city OU and add the $targetGroup to the ACL
     foreach ( $city in $g.Value ) {

         Write-Host "Adding $($g.Name) to $city"
         $targetObject = Get-ADOrganizationalUnit -Filter { Name -eq $city }
         Copy-DsAcl $sourceGroup $sourceObject $targetGroup $targetObject

     }

 }

下面的 Powershell 应该可以满足您的要求。有几个要求：

1. 您需要 Microsoft ActiveDirectory Powershell 模块。它包含在 RSAT7 中。
2. 您需要针对您的环境更新以下内容：
   1. $root- PSDrive 到您的“根”OU。你问题中的“国家”。
   2. $sourceOU- 您将从中复制 ACE 的源 OU（名称，而不是 DN）。
   3. $sourceGroup- 您要复制的 ACL 中列出的组（名称，不是 DN 或域）。
   4. $targetGroups- 用于应用 ACE 的组（名称，而非 DN 或域）和 OU（名称，而非 DN）的哈希值。
3. 这只会复制显式 ACE，而不是继承的。也许我应该考虑走上树去抓住继承的东西？
4. 我必须以域管理员身份运行它，因为我收到“访问被拒绝”错误。不过，我最初的 OU 代表团可能值得怀疑。

读完所有这些，我想我可能应该编写一个更通用的函数，CopyOuAcl并在完成后更新它。正如现在所写的，它完全针对您的问题和环境。

Import-Module ActiveDirectory

$root          = "AD:\OU=Country,DC=example,DC=com"
$sourceOU       = "City01"
$sourceACL      = Get-Acl $root.Replace("AD:\", "AD:\OU=$sourceOU,")
$sourceGroup    = "Limited_IT_Admins"

# Hash for the new groups and their OUs
$targetGroups = @{}
$targetGroups.Add("Limited_IT_Admin_01", @("City01", "City02", "City03"))
$targetGroups.Add("Limited_IT_Admin_02", @("City04", "City05"))
$targetGroups.Add("Limited_IT_Admin_03", @("City06", "City07"))

# Get the uniherited ACEs for the $sourceGroup from $sourceOU
$sourceACEs = $sourceACL |
    Select-Object -ExpandProperty Access |
        Where-Object { $_.IdentityReference -match "$($sourceGroup)$" -and $_.IsInherited -eq $False }

# Walk each targetGroup in the hash
foreach ( $g in $targetGroups.GetEnumerator() ) {

    # Get the AD object for the targetGroup
    Write-Output $g.Name
    $group      = Get-ADGroup $g.Name
    $identity   = New-Object System.Security.Principal.SecurityIdentifier $group.SID

    # Could be multiple ACEs for the sourceGroup
    foreach ( $a in $sourceACEs ) {

        # From from the sourceACE for the ActiveDirectoryAccessRule constructor  
        $adRights               = $a.ActiveDirectoryRights
        $type                   = $a.AccessControlType
        $objectType             = New-Object Guid $a.ObjectType
        $inheritanceType        = $a.InheritanceType
        $inheritedObjectType    = New-Object Guid $a.InheritedObjectType

        # Create the new "copy" of the ACE using the target group. http://msdn.microsoft.com/en-us/library/w72e8e69.aspx
        $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $identity, $adRights, $type, $objectType, $inheritanceType, $inheritedObjectType    

        # Walk each city OU of the target group
        foreach ( $city in $g.Value ) {

            Write-Output "`t$city"
            # Set the $cityOU
            $cityOU = $root.Replace("AD:\", "AD:\OU=$city,")
            # Get the ACL for $cityOU
            $cityACL = Get-ACL $cityOU
            # Add it to the ACL
            $cityACL.AddAccessRule($ace)
            # Set the ACL back to the OU
            Set-ACL -AclObject $cityACL $cityOU

        }

    }

}