Possible for Group 'Managed By' Value to Inherit Parent OU 'Managed By' Value?

Question

Is it possible to for security groups that are nested under an OU to inherit that OU's 'Managed By' value? I'd like to grant the OU Owner rights to the security groups within that OU but it seems like the only option is to manually edit each group one by one. Is there a script that automates this?

Answer 1

Hello,

This can be done using a Scheduled task and a PowerShell script. The task should be configured for the Group object type and will look like the following: Here is the script that will do the trick.

# Bind to parent OU
$parentOU = $Context.BindToObjectByDN("%adm-ParentDN%")

# Get parent OU owner
try
{
    $ouOwner = $parentOU.Get("managedBy")    
}
catch
{
    $ouOwner = $NULL
}

# Update group owner
if (-not([Softerra.Adaxes.Ldap.DN]::AreEqual($ouOwner, "%managedBy%")))
{
    $Context.TargetObject.Put("managedBy", $ouOwner)
    $Context.TargetObject.SetInfo()
}

If you want to avoid updating the managedBy property of groups with user accounts that are not owners of the OU where the groups are located, a Business Rule triggering Before updating a group should be used. The rule will check whether the managedBy property is updated with the account that owns the OU where the groups are located and cancel the operation if the accoutns do not match. The Business Rule will look like the following:

Here is the script that will be used in the Business Rule condition:

# Get group owner being set
$newGroupOwner = $Context.GetModifiedPropertyValue("managedBy")

# Get parent OU owner
$parentOU = $Context.BindToObjectByDN("%adm-ParentDN%")

try
{
    $parentOUOwner = $parentOU.Get("managedBy")
}
catch
{
    $parentOUOwner = $NULL
}

$Context.ConditionIsMet = -not([Softerra.Adaxes.Ldap.DN]::AreEqual($newGroupOwner, $parentOUOwner))