PowerShell设置AD组的所有者可以更新组员

cls
function Set-GroupManager($GroupName,$ManagerSAM)

{


try {
Import-Module ActiveDirectory -NoClobber
        $ManagerDN = (Get-ADUser -Identity $ManagerSAM -Properties * |select DistinguishedName).DistinguishedName.ToString().Trim()
        $GroupDN = (Get-ADGroup -Identity $GroupName -Properties * |select DistinguishedName).DistinguishedName.ToString().Trim()
$mgr=[ADSI]"LDAP://$ManagerDN";
$identityRef=(Get-ADUser-Filter {DistinguishedName -like$ManagerDN}).SID.Value
$sid=New-Object System.Security.Principal.SecurityIdentifier ($identityRef);

$adRule=New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($sid,`
[System.DirectoryServices.ActiveDirectoryRights]::WriteProperty,`
[System.Security.AccessControl.AccessControlType]::Allow,`
[Guid]"bf9679c0-0de6-11d0-a285-00aa003049e2");#这个数值默认都是这个,除非被修改. 可以通过ADSI中CN=Configuration -> CN=Extended-Rights -> CN=Self-Memberships -> rightsGuid

$grp=[ADSI]"LDAP://$GroupDN";

$grp.InvokeSet("managedBy",@("$ManagerDN"));
$grp.CommitChanges();

[System.DirectoryServices.DirectoryEntryConfiguration]$SecOptions=$grp.get_Options();
$SecOptions.SecurityMasks=[System.DirectoryServices.SecurityMasks]'Dacl'

$grp.get_ObjectSecurity().AddAccessRule($adRule);
$grp.CommitChanges();
}
catch
{
write-host"Update failed..."
}
}

& Set-GroupManager "DCGroups" "Managers"