en-US/about_WindowsAccessControlADObjectAccessRule.help.txt
|
.NAME
WindowsAccessControlADObjectAccessRule .SYNOPSIS Ensures one exact explicit Active Directory access rule is present or absent. .DESCRIPTION The composite key identifies exactly one explicit access control entry on a directory object, including the object type and inherited object type that scope a delegated right to one schema class or attribute set. The resource takes no credential, so the Local Configuration Manager binds LDAP as the node's own identity. Every write is confined to AllowedBaseDistinguishedName. .PARAMETER DistinguishedName Key - string The distinguished name of the directory object the rule applies to. .PARAMETER Account Key - string The principal the rule applies to. An alias is normalized by security identifier, so any spelling that resolves to the same principal matches. .PARAMETER AccessRights Key - WindowsActiveDirectoryRights The exact directory rights the entry grants or denies. .PARAMETER AccessControlType Key - System.Security.AccessControl.AccessControlType Whether the entry is an allow or a deny entry. .PARAMETER InheritanceType Key - WindowsActiveDirectoryInheritance How the entry is inherited by objects below the target. .PARAMETER ObjectType Key - string The schema GUID the right is scoped to, or empty for no object scope. Anything else must be a real GUID, so a typo can never widen the managed entry to the whole object. .PARAMETER InheritedObjectType Key - string The schema GUID of the child class the entry is inherited by, or empty for no scope. The same GUID rule applies. .PARAMETER AllowedBaseDistinguishedName Required - string The subtree the configuration is allowed to write under. A target outside it is refused before anything is written. .PARAMETER Server Write - string The domain controller to bind over signed and sealed LDAP. When empty, a writable controller is discovered. .PARAMETER TimeoutSeconds Write - int The directory operation timeout in seconds. .PARAMETER Ensure Write - WindowsAccessControlDscEnsure Whether the exact entry must be present or absent. Defaults to Present. .PARAMETER Reasons Read - WindowsAccessControlDscReason[] Returns why the resource is not in the desired state. Not configurable. |