Allow add/remove members in an AD group

October 31, 2018

By doing this programmatically you can give multiple users or group(s) the right to add or remove users from an AD group. If you do this in ADUC you can only give the user you set as ‘Managed by’ the permissions.

With Powershell

1
2
3
4
5
6
7
8
9
10
11
12
13
14

$user = Get-ADUser -identity [username]
$group = [GroupName]

$GroupObject = Get-ADGroup $group
$ACL = Get-ACL AD:$GroupObject
$ACE = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
$user.SID,
[System.DirectoryServices.ActiveDirectoryRights]::WriteProperty,
[System.Security.AccessControl.AccessControlType]::Allow,
"bf9679c0-0de6-11d0-a285-00aa003049e2",
[DirectoryServices.ActiveDirectorySecurityInheritance]::none
)
$ACL.AddAccessRule($ACE)
Set-ACL -Path AD:$GroupObject -AclObject $ACL

With dsacl.exe

1	dsacls.exe "CN=GroupName,CN=Users,DC=Domain,DC=Local" /G "domain\UserName:WP;member"

Powershell functions (to add to a module)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190

function Set-ADGroupPermissions
{
<#
.SYNOPSIS
Set special privilege in AD
.DESCRIPTION
The privileges you can set in this version:
- User or group that has the permission to change the members of in an AD group
.EXAMPLE
Set-ADGroupPermissions -UserName [Username] -TargetGroupName [GroupName] -Privilege AddRemoveMembers
.EXAMPLE
Set-ADGroupPermissions -GroupName [Groupname] -TargetGroupName [GroupName] -Privilege AddRemoveMembers
.NOTES
Author: Stian Hammer Sæten
Version: 1.0

#>
[CmdletBinding()]
param
(
[Parameter(Mandatory = $true, HelpMessage = 'Username for the user you will give permissions to', Position = 0, ParameterSetName = 'User')]
[String]
$UserName,

[Parameter(Mandatory = $true, HelpMessage = 'Groupname for the group you will give permissions to', Position = 0, ParameterSetName = 'Group')]
[String]
$GroupName,

[Parameter(Mandatory = $true, HelpMessage = 'The group you will set the permission on', Position = 1)]
[String]
$TargetGroupName,

[Parameter(Mandatory = $true, HelpMessage = 'The permissions you will set', Position = 2)]
[ValidateSet('AddRemoveMembers')]
[String]
$Privilege
)

switch ($Privilege) {
AddRemoveMembers { $GUID = 'bf9679c0-0de6-11d0-a285-00aa003049e2' }
}

if ($PSCmdlet.ParameterSetName -eq 'User')
{
$ADobject = Get-ADUser -Identity $UserName
}
if ($PSCmdlet.ParameterSetName -eq 'Group')
{
$ADobject = Get-ADGroup -Identity $GroupName
}

$GroupObject = Get-ADGroup -Identity $TargetGroupName
$ACL = Get-Acl -Path AD:$GroupObject
$ACE = New-Object -TypeName System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList (
$ADobject.SID,
[System.DirectoryServices.ActiveDirectoryRights]::WriteProperty,
[System.Security.AccessControl.AccessControlType]::Allow,
$GUID,
[DirectoryServices.ActiveDirectorySecurityInheritance]::none
)
$ACL.AddAccessRule($ACE)
Set-Acl -Path AD:$GroupObject -AclObject $ACL

Get-ADGroupPermissions -TargetGroupName $TargetGroupName -Privilege $Privilege |
Select-Object -Property @{
Name = 'Identity'
Expression = {
$_.IdentityReference
}
}, Privilege |
Sort-Object -Property Identity
}

function Remove-ADGroupPermissions
{
<#
.SYNOPSIS
Remove special privilege in AD
.DESCRIPTION
The privileges you can remove in this version:
- User or group that has the permission to change the members of in an AD group
.EXAMPLE
Remove-ADGroupPermissions -UserName [Username] -TargetGroupName [GroupName] -Privilege AddRemoveMembers
.EXAMPLE
Remove-ADGroupPermissions -GroupName [Groupname] -TargetGroupName [GroupName] -Privilege AddRemoveMembers
.NOTES
Author: Stian Hammer Sæten
Version: 1.0

#>
[CmdletBinding()]
param
(
[Parameter(Mandatory = $true, HelpMessage = 'Username for the user you will remove permissions from', Position = 0, ParameterSetName = 'User')]
[String]
$UserName,

[Parameter(Mandatory = $true, HelpMessage = 'Groupname for the group you will remove permissions from', Position = 0, ParameterSetName = 'Group')]
[String]
$GroupName,

[Parameter(Mandatory = $true, HelpMessage = 'The group you will remove the permission from', Position = 1)]
[String]
$TargetGroupName,

[Parameter(Mandatory = $true, HelpMessage = 'The permissions you will remove', Position = 2)]
[ValidateSet('AddRemoveMembers')]
[String]$Privilege
)

switch ($Privilege) {
AddRemoveMembers { $GUID = 'bf9679c0-0de6-11d0-a285-00aa003049e2' }
}

if ($PSCmdlet.ParameterSetName -eq 'User')
{
$ADobject = Get-ADUser -Identity $UserName
}
if ($PSCmdlet.ParameterSetName -eq 'Group')
{
$ADobject = Get-ADGroup -Identity $GroupName
}

$GroupObject = Get-ADGroup -Identity $TargetGroupName
$ACL = Get-Acl -Path AD:$GroupObject
$ACE = New-Object -TypeName System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList (
$ADobject.SID,
[System.DirectoryServices.ActiveDirectoryRights]::WriteProperty,
[System.Security.AccessControl.AccessControlType]::Allow,
$GUID,
[DirectoryServices.ActiveDirectorySecurityInheritance]::none
)
$ACL.RemoveAccessRule($ACE)
Set-Acl -Path AD:$GroupObject -AclObject $ACL

Get-ADGroupPermissions -TargetGroupName $TargetGroupName -Privilege $Privilege |
Select-Object -Property @{
Name = 'Identity'
Expression = {
$_.IdentityReference
}
}, Privilege |
Sort-Object -Property Identity
}

function Get-ADGroupPermissions
{
<#
.SYNOPSIS
Get special privilege in AD
.DESCRIPTION
The privileges you can get in this version:
- User or group that has the permission to change the members of in an AD group
.EXAMPLE
Get-ADGroupPermissions -TargetGroupName [GroupName] -Privilege AddRemoveMembers
.NOTES
Author: Stian Hammer Sæten
Version: 1.0

#>
[CmdletBinding()]
param
(
[Parameter(Mandatory = $true, HelpMessage = 'The group you will get the permission on', Position = 1)]
[String]
$TargetGroupName,

[Parameter(Mandatory = $true, HelpMessage = 'The permissions you will get', Position = 2)]
[ValidateSet('AddRemoveMembers')]
[String]
$Privilege
)

switch ($Privilege) {
AddRemoveMembers { $GUID = 'bf9679c0-0de6-11d0-a285-00aa003049e2' }
}

$GroupObject = Get-ADGroup -Identity $TargetGroupName
$ACL = Get-Acl -Path AD:$GroupObject
$ACL.Access |
Where-Object -Property ObjectType -EQ -Value $GUID |
Select-Object -Property *, @{
Name = 'Privilege'
Expression = {
$Privilege
}
}
}

Allow add/remove members in an AD group

admin