Comme évoqué dans l’article « Powershell : Who’s the owner of my AD objects« , il est possible que votre AD contienne des objets dont le propriétaire ne soit aucun des suivants :
- « Enterprise Admins »
- « Domain Admins«
- « Administrators«
Afin de remettre « Domain Admins » comme propriétaire des objets, nous utiliserons Powershell pour chacun des types d’objets.
Attention : La variable $NoGood est issue des scripts du précédent article, pensez à vérifier ce qu’elle retourne au préalable.
Unités d’organisation
# Organizational Units
$NoGood | foreach {
# Current OU
$DistinguishedName = $_.DistinguishedName
# Change Owner
Try {
# Define Target
$TargetObject = Get-ADOrganizationalUnit -Identity $DistinguishedName
$AdsiTarget = [adsi]"LDAP://$($TargetObject.DistinguishedName)"
# Set new Owner
$NewOwner = New-Object System.Security.Principal.NTAccount("DOMAINXXX", "Domain Admins")
$AdsiTarget.PSBase.ObjectSecurity.SetOwner($NewOwner)
$AdsiTarget.PSBase.CommitChanges()
}
Catch {
Write-Warning $($_)
$DistinguishedName
}
# Release variable
$DistinguishedName = $null
}
Les groupes
# Group
$NoGood | foreach {
# Current Group
$SamAccountName = $_.SamAccountName
# Change Owner
Try {
# Define Target
$TargetObject = Get-ADGroup $SamAccountName
$AdsiTarget = [adsi]"LDAP://$($TargetObject.DistinguishedName)"
# Set new Owner
$NewOwner = New-Object System.Security.Principal.NTAccount("DOMAINXXX", "Domain Admins")
$AdsiTarget.PSBase.ObjectSecurity.SetOwner($NewOwner)
$AdsiTarget.PSBase.CommitChanges()
}
Catch {
Write-Warning $($_)
$SamAccountName
}
# Release variable
$SamAccountName = $null
}
Les utilisateurs
# Users
$NoGood | foreach {
# Current User
$SamAccountName = $_.SamAccountName
# Change Owner
Try {
# Define Target
$TargetObject = Get-ADUser $SamAccountName
$AdsiTarget = [adsi]"LDAP://$($TargetObject.DistinguishedName)"
# Set new Owner
$NewOwner = New-Object System.Security.Principal.NTAccount("DOMAINXXX", "Domain Admins")
$AdsiTarget.PSBase.ObjectSecurity.SetOwner($NewOwner)
$AdsiTarget.PSBase.CommitChanges()
}
Catch {
Write-Warning $($_)
$SamAccountName
}
# Release variable
$SamAccountName = $null
}
Les ordinateurs
# Computers
$NoGood | foreach {
# Current Computer
$SamAccountName = $_.SamAccountName
# Change Owner
Try {
# Define Target
$TargetObject = Get-ADComputer $SamAccountName
$AdsiTarget = [adsi]"LDAP://$($TargetObject.DistinguishedName)"
# Set new Owner
$NewOwner = New-Object System.Security.Principal.NTAccount("DOMAINXXX", "Domain Admins")
$AdsiTarget.PSBase.ObjectSecurity.SetOwner($NewOwner)
$AdsiTarget.PSBase.CommitChanges()
}
Catch {
Write-Warning $($_)
$SamAccountName
}
# Release variable
$SamAccountName = $null
}
0 commentaires