I've inherited control of an OU within an enterprise Active Directory domain. All of the computer objects in our OU are owned (and only writeable by) my predecessor. This prevents me from re-adding these computers unless I either delete the objects (in which case, the new objects will be owned by whatever account I add them with) or add write permissions of all of our OU admins. I want the later.
So, I'm looking for a way to make a VBA/Powershell/other script which can be pointed to an OU and which can, for every computer object in that OU:
- Change the ownership of the object to a service/dept account we use
- Add write permissions on the object to include our OU admins group
Actually, the VBA/Powershell preference is only because I'm figuring that this script might need to be run on one of the DC's, and I don't have control over what is installed on them. If it's possible to do this over the network with standard LDAP tools, then I guess any language will do.