Security Permissions on AD Objects

[[AK]Nuts]

Okay... here's a new one:

User objects are found in Active Directory (AD). I can open AD and right click on a user to open the properties on it. I can then go to the security tab and adjusted the special permissions to allow a specific user specific rights to that object.

How can I modify those permissions via command line?

Or is there any other way of doing this?

Basically I don't want to give anyone the administrator rights on the server. I don't have access the server. I don't want to give up the password. But I can deliver a batch file or other program that I can run under admin rights without their knowledge.

Maybe a PERL script or some sort of tool that records my actions here to I can duplicate it via some tool? ARG!!!!!

[[AK]Nuts]

Okay, I found DSACLS.exe can do the trick. Does anyone have a copy of this... It should be parts of the resource kit but during my office move I lost mine and need a copy of the file quick.. Thanks guys

[[AK]The Beast]

I found a Windows 2000 Server resource kit CD, but it didn't have that tool on it. A Google search informs me that it's on the Windows 2000 CD itself, in the \tools directory.

[Slaughter]

"I used to be with 'it'. But then they changed what 'it' was. Now what I'm with isn't 'it' and what's 'it' seems weird and scary." -Abe Simpson

its so true!!


On a side note: just use linux.. its the answer to all of Microsoft's problems..

[[AK]Nuts]

Thanks... found it.

I love Microsoft documention. if you do a dscacls /? the help file tells you to use a /g switch to grant permissions. After about an hour of beating my head against the wall I try /G and it works. Way to go microsoft!