Script to set active directory object security

[meastaugh1]

Hi,

With reference to this post, I need some script to revoke the ACE for Everyone on a contact object, preferably recursively for all objects in an OU/child OUs.

I've tried searching for something similar, but no luck so far. Can anyone help?

cheers

[PiqueABoo]

I threw this together mostly via cut-paste from a couple of my ADSI scripts. It's JScript, definitely not production-quality but should work. Change the ADPath to point to your parent OU and run as Admin.

var cTarget = "Everyone";
var cADPath = "LDAP://OU=someou,DC=school,DC=internal";

ScanOU(GetObject(cADPath));

function ScanOU(oOU)
{
	var e = new Enumerator(oOU);
	while(!e.atEnd())	
	{
		if ( e.item().Class == "contact") RemoveACE(e.item());
		if ( e.item().Class == "organizationalUnit") ScanOU(e.item());	
		e.moveNext();
	}
}

function RemoveACE(oC)
{
	var sd = oC.Get("ntSecurityDescriptor");
	var dacl = sd.DiscretionaryAcl;
	var e	= new Enumerator(dacl);	
	while(!e.atEnd())
	{
		if (e.item().Trustee == cTarget) dacl.RemoveAce(e.item());
		e.moveNext();
	}	
	sd.DiscretionaryAcl = dacl;
	oC.Put("ntSecurityDescriptor",sd);
	oC.SetInfo();	
}

There's enough there for any competent VBSer to translate, make more efficient, informative, bombproof etc.

[meastaugh1]

Thank you, I'll give it a go.

[PiqueABoo]

A slight modification just in case what you really wanted was existing Authenticated User ACEs on contact objects changed into ACEs for "my group" ;b

var cOldTrustee = "nt authority\\authenticated users";	//must be lower case
var cNewTrustee = "DOMAIN\\My Group";                    //change this to your domain & group
var cADPath = "LDAP://OU=someou,DC=school,DC=internal";  //change this for your AD path

ScanOU(GetObject(cADPath));

function ScanOU(oOU)
{
	var e = new Enumerator(oOU);
	while(!e.atEnd())	
	{
		if ( e.item().Class == "contact") ReplaceACE(e.item());
		if ( e.item().Class == "organizationalUnit") ScanOU(e.item());	
		e.moveNext();
	}
}

function ReplaceACE(oC)
{
	var sd = oC.Get("ntSecurityDescriptor");
	var dacl = sd.DiscretionaryAcl;
	var e	= new Enumerator(dacl);	
	while(!e.atEnd())
	{
		if (e.item().Trustee.toLowerCase() == cOldTrustee) e.item().Trustee = cNewTrustee;
		e.moveNext();
	}	
	sd.DiscretionaryAcl = dacl;
	oC.Put("ntSecurityDescriptor",sd);
	oC.SetInfo();	
}

[meastaugh1]

Fantastic! Thanks very much for your help.