0

i'm looking for a way to grant permissions to local group (IIS_IUSRS), i found this Powershell script HERE its worked very well, for a domain user, but i'm trying to grant the access to a local group, not sure what need to be change in the script in case to get it to work.

Not: i'm looking for a powershell script or command, i cannot use any third party software.

here is the script 


$user = "sql2012agent"
$domain = "MYDOMAIN"
$appdesc = "Microsoft SQL Server Integration Services 11.0"
$app = get-wmiobject -query ('SELECT * FROM Win32_DCOMApplicationSetting WHERE Description = "' + $appdesc + '"') -enableallprivileges
#$appid = "{83B33982-693D-4824-B42E-7196AE61BB05}"
#$app = get-wmiobject -query ('SELECT * FROM Win32_DCOMApplicationSetting WHERE AppId = "' + $appid + '"') -enableallprivileges
$sdRes = $app.GetLaunchSecurityDescriptor()
$sd = $sdRes.Descriptor
$trustee = ([wmiclass] 'Win32_Trustee').CreateInstance()
$trustee.Domain = $domain
$trustee.Name = $user
$fullControl = 31
$localLaunchActivate = 11
$ace = ([wmiclass] 'Win32_ACE').CreateInstance()
$ace.AccessMask = $localLaunchActivate
$ace.AceFlags = 0
$ace.AceType = 0
$ace.Trustee = $trustee
[System.Management.ManagementBaseObject[]] $newDACL = $sd.DACL + @($ace)
$sd.DACL = $newDACL
$app.SetLaunchSecurityDescriptor($sd)

any help will be appreciated.

Thank you

Ayad
  • 21
  • 2
  • 6
  • The domain for local users is generally the name of the server/pc? – Scepticalist Dec 05 '19 at 06:55
  • i tried it, but its doesn't work to replace Domain name with the hostname, even if its works, i'm trying to add local group not a single local user, but thank you for mentioning that. – Ayad Dec 05 '19 at 12:38
  • IIS_IUSRS is a built-in group, so using BUILTIN as domain might work – Dark Daskin Dec 06 '19 at 18:29
  • 1
    I believe you should try one of these: \\\ 1. leave out the `$trustee.Domain = $domain`, just set the trustee Name to 'IIS_IUSRS', or \\\ 2. use the `SIDString` property instead of Name and Domain: `$trustee.SIDString = 'S-1-5-17'`. See: [Well-KnownSids](https://support.microsoft.com/nl-nl/help/243330/well-known-security-identifiers-in-windows-operating-systems) – Theo Dec 06 '19 at 20:36

0 Answers0