Repository navigation
Set‑ADObjectSecurityDescriptor
raandree edited this page Sep 7, 2026
·
2 revisions
Sets DACL descriptors on bounded Active Directory objects.
Set-ADObjectSecurityDescriptor [-Server <String>] [-DistinguishedName] <Object[]>
-AllowedBaseDistinguishedName <String> -Sddl <String> [-ExpectedObjectGuid <Guid>]
[-Credential <PSCredential>] [-TimeoutSeconds <Int32>] [-ThrottleLimit <Int32>] [-PassThru]
[-WhatIf] [-Confirm] [<CommonParameters>]
Validates SDDL, immutable object identity, protected-target rules, and an explicit allowed OU before replacing only the target DACL over LDAP.
Set-ADObjectSecurityDescriptor -Server dc01.example.test -DistinguishedName $dn -AllowedBaseDistinguishedName $ou -Sddl $sddl -WhatIf
Previews replacing only the selected object's DACL.
The organizational unit that bounds every permitted mutation.
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseAn optional credential used only for the direct LDAP bind to Server.
Type: PSCredential
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseOne or more distinguished names to modify.
Type: Object[]
Parameter Sets: (All)
Aliases: Path
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: FalseRequires the target to retain this immutable object GUID. Restore uses this value to reject a distinguished name reused after preparation.
Type: Guid
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: [guid]::Empty
Accept pipeline input: False
Accept wildcard characters: FalseReturns the stored DACL descriptor after persistence.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: FalseA structurally valid SDDL document containing a non-null DACL.
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseThe explicit DNS name of the final writable domain controller. When it is omitted, one writable domain controller is located in the current computer's domain and pinned for the whole command.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseLimits concurrently processed immutable object targets from 1 through 64.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: [Math]::Max(1, [Math]::Min(8, [Environment]::ProcessorCount))
Accept pipeline input: False
Accept wildcard characters: FalseSets the LDAP request timeout from 1 through 300 seconds.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 10
Accept pipeline input: False
Accept wildcard characters: FalsePrompts you for confirmation before running the cmdlet.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseShows what would happen if the cmdlet runs. The cmdlet is not run.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseThis cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
- Add-ADObjectAccessRule
- Add-CertificatePrivateKeyAccessRule
- Add-NTFSAccessRule
- Add-NTFSAuditRule
- Add-ProcessAccessRule
- Add-ProcessAuditRule
- Add-RegistryKeyAccessRule
- Add-RegistryKeyAuditRule
- Add-ScheduledTaskAccessRule
- Add-ServiceAccessRule
- Add-ServiceAuditRule
- Add-SmbShareAccessRule
- Add-TaskFolderAccessRule
- Backup-NTFSItemSecurityDescriptor
- Backup-WindowsSecurityDescriptor
- Clear-ADObjectAccessRule
- Clear-NTFSAccessRule
- Clear-NTFSAuditRule
- Clear-ProcessAccessRule
- Clear-ProcessAuditRule
- Clear-RegistryKeyAccessRule
- Clear-RegistryKeyAuditRule
- Clear-ServiceAccessRule
- Clear-ServiceAuditRule
- Copy-NTFSItemSecurityDescriptor
- Disable-NTFSItemInheritance
- Disable-RegistryKeyInheritance
- Disable-WindowsPrivilege
- Edit-NTFSItemSecurityDescriptor
- Edit-RegistryKeySecurityDescriptor
- Enable-NTFSItemInheritance
- Enable-RegistryKeyInheritance
- Enable-WindowsPrivilege
- Get-ADObjectAccessRule
- Get-ADObjectCallerEffectiveAccess
- Get-ADObjectSchemaDefaultAccessRule
- Get-ADObjectSecurityDescriptor
- Get-CertificatePrivateKeyAccessRule
- Get-CertificatePrivateKeySecurityDescriptor
- Get-NTFSAccessRule
- Get-NTFSAuditRule
- Get-NTFSItemEffectiveAccess
- Get-NTFSItemInheritance
- Get-NTFSItemOwner
- Get-NTFSItemSecurityDescriptor
- Get-ProcessAccessRule
- Get-ProcessAuditRule
- Get-ProcessSecurityDescriptor
- Get-RegistryKeyAccessRule
- Get-RegistryKeyAuditRule
- Get-RegistryKeyInheritance
- Get-RegistryKeySecurityDescriptor
- Get-ScheduledTaskAccessRule
- Get-ScheduledTaskSecurityDescriptor
- Get-ServiceAccessRule
- Get-ServiceAuditRule
- Get-ServiceSecurityDescriptor
- Get-SmbShareAccessRule
- Get-SmbShareEffectiveAccess
- Get-SmbShareSecurityDescriptor
- Get-TaskFolderAccessRule
- Get-TaskFolderSecurityDescriptor
- Get-WindowsAccessControlMetric
- Get-WindowsPrivilege
- Invoke-WindowsAccessControl
- New-NTFSAccessRule
- New-NTFSAuditRule
- Remove-ADObjectAccessRule
- Remove-CertificatePrivateKeyAccessRule
- Remove-NTFSAccessRule
- Remove-NTFSAuditRule
- Remove-ProcessAccessRule
- Remove-ProcessAuditRule
- Remove-RegistryKeyAccessRule
- Remove-RegistryKeyAuditRule
- Remove-ScheduledTaskAccessRule
- Remove-ServiceAccessRule
- Remove-ServiceAuditRule
- Remove-SmbShareAccessRule
- Remove-TaskFolderAccessRule
- Resolve-WindowsIdentity
- Restore-NTFSItemSecurityDescriptor
- Restore-WindowsSecurityDescriptor
- Set-ADObjectAccessRule
- Set-ADObjectSecurityDescriptor
- Set-CertificatePrivateKeySecurityDescriptor
- Set-NTFSAccessRule
- Set-NTFSAuditRule
- Set-NTFSItemOwner
- Set-NTFSItemSecurityDescriptor
- Set-ProcessAccessRule
- Set-ProcessAuditRule
- Set-ProcessSecurityDescriptor
- Set-RegistryKeyAccessRule
- Set-RegistryKeyAuditRule
- Set-RegistryKeySecurityDescriptor
- Set-ScheduledTaskSecurityDescriptor
- Set-ServiceAccessRule
- Set-ServiceAuditRule
- Set-ServiceSecurityDescriptor
- Set-SmbShareSecurityDescriptor
- Set-TaskFolderSecurityDescriptor
- Test-CertificatePrivateKeyCriticalBinding
- Test-NTFSItemAcl
- Test-WindowsPrivilege
- WindowsAccessControlADObjectAccessRule
- WindowsAccessControlADObjectSecurityDescriptor
- WindowsAccessControlCertificatePrivateKeyAccessRule
- WindowsAccessControlCertificatePrivateKeySecurityDescriptor
- WindowsAccessControlNtfsAccessRule
- WindowsAccessControlNtfsSecurityDescriptor
- WindowsAccessControlProcessAccessRule
- WindowsAccessControlProcessSecurityDescriptor
- WindowsAccessControlRegistryKeyAccessRule
- WindowsAccessControlRegistryKeySecurityDescriptor
- WindowsAccessControlScheduledTaskAccessRule
- WindowsAccessControlScheduledTaskSecurityDescriptor
- WindowsAccessControlServiceAccessRule
- WindowsAccessControlServiceControlManagerAccessRule
- WindowsAccessControlServiceControlManagerSecurityDescriptor
- WindowsAccessControlServiceSecurityDescriptor
- WindowsAccessControlSmbShareAccessRule
- WindowsAccessControlSmbShareSecurityDescriptor
- WindowsAccessControlTaskFolderAccessRule
- WindowsAccessControlTaskFolderSecurityDescriptor