en-US/about_WindowsAccessControlADObjectSecurityDescriptor.help.txt
|
.NAME
WindowsAccessControlADObjectSecurityDescriptor .SYNOPSIS Manages the exact DACL of an Active Directory object. .DESCRIPTION Compares the directory object's access control list against the desired SDDL and rewrites it. The resource takes no credential, so the Local Configuration Manager binds LDAP as the node's own identity and a compiled configuration never carries directory credentials. Every write is confined to AllowedBaseDistinguishedName, so a configuration states its own containment boundary. .PARAMETER DistinguishedName Key - string The distinguished name of the directory object whose DACL is managed. .PARAMETER Sections Key - WindowsSecurityDescriptorSection The security descriptor sections this resource owns. Only the access section is supported for a directory object. .PARAMETER AllowedBaseDistinguishedName Required - string The subtree the configuration is allowed to write under. A target outside it is refused before anything is written. .PARAMETER Sddl Required - string The desired DACL in SDDL form. Capture it from Get-ADObjectSecurityDescriptor. .PARAMETER Server Write - string The domain controller to bind over signed and sealed LDAP. When empty, a writable controller is discovered. Pin it when two writes must be serialized, because a security descriptor is one replicated attribute and the losing write is discarded whole. .PARAMETER ObjectGuid Write - string The immutable identity of the intended object. A distinguished name can be reused after a delete and recreate, so when this is set and the name now resolves to a different object the resource fails closed. .PARAMETER TimeoutSeconds Write - int The directory operation timeout in seconds. .PARAMETER Reasons Read - WindowsAccessControlDscReason[] Returns why the resource is not in the desired state. Not configurable. |