I want to delegate control of the TestUsers
organizational unit to a user NickA
and give the following permissions to it:
Create, delete, and manage user accounts
Reset user passwords and force password change at next logon
Read all user information
Create, delete and manage groups
Modify the membership of a group
The only method that I found is the following, but I cannot find the correct permissions to assign:
$acc = Get-ADUser NickA
$sid = new-object System.Security.Principal.SecurityIdentifier $acc.SID
$guid = new-object Guid bf967aba-0de6-11d0-a285-00aa003049e2
$ou = Get-ADOrganizationalUnit -Identity TestUsers
$acl = Get-ACL -Path "AD:$($ou.DistinguishedName)"
$acl.AddAccessRule($(new-object System.DirectoryServices.ActiveDirectoryAccessRule $sid,"CreateChild,DeleteChild","Allow",$guid))
Set-ACL -ACLObject $acl -Path "AD:$($ou.DistinguishedName)"