Powershell:如何设置读/写服务主体名称AD权限？

Question

在Powershell中,如何设置读/写服务主体名称AD用户权限？

通常在我的构建过程中,我使用ADSIedit导航到该对象,然后通过所有安全选项卡下来选中旁边的复选标记:

• 阅读服务主体名称
• 写服务主体名称

但是通过ADSIedit导航可能需要很长时间,因此我正在尝试编写该过程的脚本.如果我有一个PowerShell LDAP绑定创建了一个新用户,我如何使用PowerShell为这个用户帐户设置这两个属性？

以下是我的安装脚本可能相关部分的被破解的代码片段:

$strDomain = "dc=my,dc=com"
$objDomain = [ADSI] "LDAP://" + strDomain 
$strSCCMSQLPW = Read-Host -assecurestring "Please enter a password for the " + $strSCCMSQL + " account: "
New-ADUser -SamAccountName $strSCCMSQL + -Name $strSCCMSQL -AccountPassword $strSCCMSQLPW -Enabled $true -Path $strUsersOU + "," + $strDomain -PasswordNeverExpires $true

Answer 1

您需要将ActiveDirectoryAccessRule对象添加到目标对象的ACL中.要设置属性特定的rigths,诀窍是将schemaIDGUID传递给属性.首先,我们需要从Service-Principal-Name模式条目中找到schemaIDGUID.在示例代码中,我静态地引用了Service-Principal-Name,更好的是搜索ldapDisplayname来查找条目,但我相信你可以对它进行排序.无论如何,这段代码应该完成这项工作:

Function Set-SpnPermission {
    param(
        [adsi]$TargetObject,
        [Security.Principal.IdentityReference]$Identity,
        [switch]$Write,
        [switch]$Read
    )
    if(!$write -and !$read){
        throw "Missing either -read or -write"
    }
    $rootDSE = [adsi]"LDAP://RootDSE"
    $schemaDN = $rootDSE.psbase.properties["schemaNamingContext"][0]
    $spnDN = "LDAP://CN=Service-Principal-Name,$schemaDN"
    $spnEntry = [adsi]$spnDN
    $guidArg=@("")
    $guidArg[0]=$spnEntry.psbase.Properties["schemaIDGUID"][0]
    $spnSecGuid = new-object GUID $guidArg

    if($read ){$adRight=[DirectoryServices.ActiveDirectoryRights]"ReadProperty" }
    if($write){$adRight=[DirectoryServices.ActiveDirectoryRights]"WriteProperty"}
    if($write -and $read){$adRight=[DirectoryServices.ActiveDirectoryRights]"readproperty,writeproperty"}
    $accessRuleArgs = $identity,$adRight,"Allow",$spnSecGuid,"None"
    $spnAce = new-object DirectoryServices.ActiveDirectoryAccessRule $accessRuleArgs
    $TargetObject.psbase.ObjectSecurity.AddAccessRule($spnAce)
    $TargetObject.psbase.CommitChanges()    
    return $spnAce
}

用于调用函数的示例行...

$TargetObject = "LDAP://CN=User,OU=My User Org,DC=domain,DC=net"
$Identity = [security.principal.ntaccount]"domain\user"

Set-SpnPermission -TargetObject $TargetObject -Identity $Identity -write -read