Frage: Wie werden einzelne AD-Attribute zur Bearbeitung über AD-Gruppe berechtigt

Add-ADPermission -Identity "OU=TestOU,dc=domain,dc=local" -User GRUPPEXYZ -AccessRights WriteProperty,ReadProperty -Properties displayName,givenName,sn,company,physicalDeliveryOfficeName,department,streetAddress,postalcode,l,telephonenumber,mobile,facsimileTelephoneNumber -InheritedObjectType User -InheritanceType Descendents

@echo off & setlocal
set OURoot="OU=TEST_OU_HEN,DC=domain-name,DC=local"  
set GRUPPE=domain-name\AD-Adressbearbeitung
set RECHTE=RPWP
set attributes=displayName givenName sn company physicalDeliveryOfficeName department streetAddress postalcode l telephonenumber mobile facsimileTelephoneNumber
for %%a in (%attributes%) DO @(
  dsacls %OURoot% /I:T /G %GRUPPE%:%RECHTE%;%%a;user
)

function Delegate-ADProperty {
    param(
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][ValidateScript({Get-ACL "AD:$_"})][string]$ObjectDN,  
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][System.Security.Principal.IdentityReference]$Account,
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][string[]]$Attributes,
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][string]$InheritingObjects,
        [Parameter()][System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance]::Descendents,
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][string]$AccessRights,
        [Parameter()][ValidateSet("Allow","Deny")][string]$AccessControlType = "Allow"  

    )
    # check class GUID of inheriting objects
    $GUID_CLASS = (Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -Filter "ldapDisplayName -eq '$InheritingObjects' -and objectClass -eq 'classSchema'" -Properties schemaIDGUID).schemaIDGUID -as [guid]  
    if ($GUID_CLASS -eq $null){
        Write-Error -Message "Inheriting Object Class Name '$InheritingObjects' could not be found." -Category InvalidArgument  
        return
    }
    
    # check attribute existance
    $schemacontext = (Get-ADRootDSE).schemaNamingContext
    # get acl of AD object
    $acl = Get-ACL "AD:$ObjectDN"  

    foreach($attribute in $attributes){
        try{
            # get # get attribute GUID
            $GUID_ATTRIBUTE = (Get-ADObject -SearchBase $schemacontext -Filter "ldapDisplayName -eq '$attribute' -and objectClass -eq 'attributeSchema'" -Properties schemaIDGUID).schemaIDGUID -as [guid]  
            if ($GUID_ATTRIBUTE -eq $null){
                throw "Attribute '$attribute' could not be found."  
            }
            # create AccesRule
            $rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($Account,$AccessRights,$AccessControlType,$GUID_ATTRIBUTE,$inheritanceType,$GUID_CLASS) -EA Stop
            # Add rule to acl
            $acl.AddAccessRule($rule)
            $rule
        }catch{
            write-error -Message $_.Exception.Message
        }
    }
    # save acl to object
    Set-ACL "AD:$ObjectDN" $acl  
}

Delegate-ADProperty -ObjectDN 'OU=Verwaltung,DC=domain,dc=tld' -Account ([System.Security.Principal.NTAccount]"Max.Muster") -Attributes 'displayName','givenName','sn' -InheritingObjects 'user' -AccessRights "ReadProperty,WriteProperty"  -InheritanceType Descendents