views:

53

answers:

3

I have a script that creates two groups, a hand full of folders, and sets permissions on those folders. In my testing environment all of these processes work without issue but in my production environment I run into a problem. Setting the permissions on the folders fail since the groups I created have not replicated through all 8 of my domain controllers. Can have PowerShell work with only one of the DC's so I don't have to wait for the replication? Should I put the script to sleep for X seconds? Or is there some way to see if the groups are on all the DC's or at least on the one I am working?

This is how I am making the groups:

New-ADGroup -Name $Admin_GRP -path "OU=Users,OU=Sandbox,DC=test,DC=local" -GroupScope Global
New-ADGroup -Name $User_GRP -path "OU=Users,OU=Sandbox,DC=test,DC=local" -GroupScope Global

This is how I am setting the permissions on one of the folders:

#Set permissions on root directory
$ACL = Get-Acl $PathToFolder
#For Admin
$Permission = $Admin_GRP,"Write,ReadAndExecute,Synchronize,DeleteSubdirectoriesAndFiles","Allow"
$Access_Rule = New-Object System.Security.AccessControl.FileSystemAccessRule $Permission
$ACL.AddAccessRule($Access_Rule)
$ACL | Set-Acl $PathToFolder
#For Users
$Permission = $User_GRP,"ReadAndExecute,Synchronize","Allow"
$Access_Rule = New-Object System.Security.AccessControl.FileSystemAccessRule $Permission
$ACL.AddAccessRule($Access_Rule)
$ACL | Set-Acl $PathToFolder
A: 

Set the permission on the SID of the new group instead of it's name/samaccountname.

Remko
I am getting the same error "Exception calling "Translate" with "1" argument(s): "Some or all identity references could not be translated."At :line:36 char:83+ $Admin_SID = (new-object system.security.principal.NtAccount($Admin_GRP)).translate <<<< ([system.security.principal.securityidentifier]).value"
pizzim13
Yes you are running into the same problem here, you should read the SID from the created object (I assume $Admin_GRP is the accountname and not an object)
Remko
A: 

I decided to use a while loop to check for the group replication.

#Wait for group replication
while ($Admin_GRP_CHK -ne 'group')
{$Admin_GRP_CHK = (Get-ADGroup $Admin_GRP).ObjectClass
trap {'Admin group not replicated yet. Waiting 10 seconds.' -f $_.Exception.Message;    continue}
Start-Sleep -Seconds 10
}
Write-Host 'Admin group exists'
pizzim13
In a larger AD environment it may take a while for the replication so I think this is a bad approach.
Remko
+1  A: 

In the past, when writing shell scripts, I've called NLTEST.EXE to point the current PC/server at a specific DC (I normally choose the PDC emulator). I can't remember which switch I used. Not sure if this will help.

Simon Catlin