Rechte für das Verschieben von Computerobjekten aus der Standard Computer OU

$newmachine=(Get-WinEvent -FilterHashtable @{Logname='Security'; ID=4741} -MaxEvents 1 | ForEach-Object {  
	$xml = [xml]($_.ToXml() -replace 'xmlns=', 'dummy=')  
	$_ | Select-Object -Property `
		TimeCreated,
		Id,
		@{n='DnsHostName';	e={$xml.SelectSingleNode("Event/EventData/Data[@Name='DnsHostName']").InnerText}}  
}).DnsHostName
$a, $b, $c = $newmachine.Split(".")  
if ($a -like "Workstation*") {dsmove "CN=$a,CN=Computers,DC=dom,DC=local" -newparent ou=Workstations,DC=dom,DC=local}  

#muesste als Task am DC laufen.
#Executor: System
#Action: dieses Skript
#Trigger:Logname='Security'; Source: Microsoft Windows security auditing", ID=4741 
#Zweck in diesem Beispiel: alle PCs die mit dem Namen Workstationxyz erstellt werden, werden sofort in die OU Workstations geschoben.

distinguishedName (Distinguished Name)
rdn (name)
cn (Name) 

Import-Module ActiveDirectory
# --------------
# QUELL OU
$OU_SOURCE = "AD:CN=Computers,DC=TESTLAB,dc=INTERN"  
# ZIEL OU
$OU_TARGET = "AD:OU=Verwaltung,DC=TESTLAB,dc=INTERN"  
# Gruppe / Account
$account = [System.Security.Principal.NTAccount]"TESTLAB\mygroup"  
# --------------
$acl_source = Get-ACL $OU_SOURCE
$acl_target = Get-ACL $OU_TARGET

(New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($account,"Self,WriteProperty",'Allow','{bf9679e4-0de6-11d0-a285-00aa003049e2}','Descendents','{bf967a86-0de6-11d0-a285-00aa003049e2}')),  
(New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($account,"Self,WriteProperty",'Allow','{bf96793f-0de6-11d0-a285-00aa003049e2}','Descendents','{bf967a86-0de6-11d0-a285-00aa003049e2}')),  
(New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($account,"Self,WriteProperty",'Allow','{bf967a0e-0de6-11d0-a285-00aa003049e2}','Descendents','{bf967a86-0de6-11d0-a285-00aa003049e2}')),  
(New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($account,"DeleteChild",'Allow','{bf967a86-0de6-11d0-a285-00aa003049e2}','None',[guid]::Empty)) | %{  
    $acl_source.AddAccessRule($_)
}
Set-ACL $OU_SOURCE $acl_source

(New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($account,"CreateChild",'Allow','{bf967a86-0de6-11d0-a285-00aa003049e2}','None',[guid]::Empty)),  
(New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($account,"Self,WriteProperty",'Allow','{bf9679e4-0de6-11d0-a285-00aa003049e2}','Descendents','{bf967a86-0de6-11d0-a285-00aa003049e2}')),  
(New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($account,"Self,WriteProperty",'Allow','{bf96793f-0de6-11d0-a285-00aa003049e2}','Descendents','{bf967a86-0de6-11d0-a285-00aa003049e2}')) | %{  
    $acl_target.AddAccessRule($_)
}
Set-ACL $OU_TARGET $acl_target