Setting "Advanced security settings" on an OU using Powershell

Question

Hello,
I have been tasked to create an OU with the simular permissions as another. On the current OU, the admin1 acount has special permissions (set within the Advanced Security Settings). For the new OU, they want a new admin2 account to have the same permissions
on the OU as admin1 has on the current OU.
I was able to extract the OU permissions using the following Powershell script:
Get-QADObject 'OU=Temp,OU=,OU=Group,DC=Department,DC=Company,DC=com' -SecurityMask Dacl -sizelimit 0 |
Get-QADPermission -Inherited -SchemaDefault |
Select-Object account, rights, source, appliesto |
Sort-Object account |
Export-Csv c:\temp\report.csv -NoTypeInformation
However, Powershell script did not provide the "Advanced Security Settings". Therefore, I am looking for a couple Powershell commands that:
1. Copies the permission entries of the Advanced Security Settings Properties on an OU
or
2. Sets the permission entries of the Advanced Security Settings Properties on an OU
Any help would be greatly appreciated.
Mxer4life

Answer 1

Hi,
Please try with the following code to copy the atestuser1's ACL on TempOU1 and assign atestuser2 on TempOU2. Please be advised to test in your lab/test environment first. I tested only once. :)
$ou1 = [adsi]"LDAP://OU=TempOU1,dc=adatum,dc=lab"
$user1 = 'adatum\atestuser1'
$ou2 = [adsi]"LDAP://OU=TempOU2,dc=adatum,dc=lab"
$user2 = 'adatum\atestuser2'
$acl1 = $ou1.psbase.ObjectSecurity.Access | ? {$_.IdentityReference -eq $user1}
Write-host ($acl1 | out-string)
$acl2 = $acl1 | % { New-Object -TypeName System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList ([System.Security.Principal.NTAccount]$user2), $_.ActiveDirectoryRights, $_.AccessControlType, $_.ObjectType, $_.InheritanceType, $_.InheritedObjectType }
Write-host ($acl2 | out-string)
$acl2 | % { $ou2.psbase.ObjectSecurity.AddAccessRule($_) }
$ou2.psbase.CommitChanges()
Write-host "After update with $user2"
Write-host ($ou2.psbase.ObjectSecurity.Access | ? {$_.IdentityReference -eq $user2} | out-string)
rgds,
AZ