我正在开发一个PS脚本，它将为用户提供一个graphics用户界面（GUI）和一些button，以便执行一些基本任务，例如解锁帐户，启用/禁用，更改密码和查杀进程/closures用户。 不工作的部分是：启用/禁用用户和更改密码。
首先，一切工作作为域pipe理员，但我不能让用户一个域pipe理员，所以请不要build议:)
这是更改密码部分：
$name = "osman" $Searcher = [ADSISearcher]"(sAMAccountName=$Name)" $Results = $Searcher.FindOne() $password = "pezevenk@321" [string]$adspath = $Results.Properties.adspath $enable = [ADSI]$adspath $enable.psbase.invoke("SetPassword", $password) $enable.psbase.CommitChanges() 错误是非常通用的：
Exception calling "Invoke" with "2" argument(s): "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))" At line:14 char:13 + $enable.psbase.invoke("SetPassword", $password)
现在，很明显，我试图给予用户适当的权限，即使我尝试了这个：我正在运行此用户具有“重置密码”和“更改密码”权限委托AD中的“用户”文件夹其中包括所有的用户。
有什么方法可以看到我错过了什么权限？ 你们能想到其他的东西吗？
编辑：这些是OU的权限：
"CN=Users,DC=domainname,DC=root,DC=com","All","User","ReadProperty, GenericExecute","Descendents","00000000-0000-0000-0000-000000000000","bf967aba-0de6-11d0-a285-00aa003049e2","InheritedObjectAceTypePresent","Allow","domainname\osman","False","ContainerInherit","InheritOnly" "CN=Users,DC=domainname,DC=root,DC=com","Pwd-Last-Set","User","ReadProperty, WriteProperty","Descendents","bf967a0a-0de6-11d0-a285-00aa003049e2","bf967aba-0de6-11d0-a285-00aa003049e2","ObjectAceTypePresent, InheritedObjectAceTypePresent","Allow","domainname\osman","False","ContainerInherit","InheritOnly" "CN=Users,DC=domainname,DC=root,DC=com","Lockout-Time","User","WriteProperty","Descendents","28630ebf-41d5-11d1-a9c1-0000f80367c1","bf967aba-0de6-11d0-a285-00aa003049e2","ObjectAceTypePresent, InheritedObjectAceTypePresent","Allow","domainname\osman","False","ContainerInherit","InheritOnly" "CN=Users,DC=domainname,DC=root,DC=com","User-Account-Control","User","WriteProperty","Descendents","bf967a68-0de6-11d0-a285-00aa003049e2","bf967aba-0de6-11d0-a285-00aa003049e2","ObjectAceTypePresent, InheritedObjectAceTypePresent","Allow","domainname\osman","False","ContainerInherit","InheritOnly" "CN=Users,DC=domainname,DC=root,DC=com","User-Force-Change-Password","User","ExtendedRight","Descendents","00299570-246d-11d0-a768-00aa006e0529","bf967aba-0de6-11d0-a285-00aa003049e2","ObjectAceTypePresent, InheritedObjectAceTypePresent","Allow","domainname\osman","False","ContainerInherit","InheritOnly" "CN=Users,DC=domainname,DC=root,DC=com","User-Change-Password","User","ExtendedRight","Descendents","ab721a53-1e2f-11d0-9819-00aa0040529b","bf967aba-0de6-11d0-a285-00aa003049e2","ObjectAceTypePresent, InheritedObjectAceTypePresent","Allow","domainname\osman","False","ContainerInherit","InheritOnly" "CN=Users,DC=domainname,DC=root,DC=com","User-Change-Password","User","ExtendedRight","Descendents","ab721a53-1e2f-11d0-9819-00aa0040529b","bf967aba-0de6-11d0-a285-00aa003049e2","ObjectAceTypePresent, InheritedObjectAceTypePresent","Allow","domainname\osman","True","ContainerInherit","InheritOnly" "CN=Users,DC=domainname,DC=root,DC=com","User-Force-Change-Password","User","ExtendedRight","Descendents","00299570-246d-11d0-a768-00aa006e0529","bf967aba-0de6-11d0-a285-00aa003049e2","ObjectAceTypePresent, InheritedObjectAceTypePresent","Allow","domainname\osman","True","ContainerInherit","InheritOnly"
您可以编辑原始的AD.msc并根据需要添加function。
这里有一些链接：
自定义AD控制台
右键单击密码重置
右键单击解锁
添加额外的列
我知道用户设置自己的密码的唯一方法是这个命令。 Set-ADAccountPassword -Identity $ Name -Reset -NewPassword（ConvertTo-SecureString $ Password -AsPlainText -force）-PassThru它将提示他们当前的密码，或者如果你不填写NewPassword，它将提示两者。 如果您尝试提供帮助台types的人员，则这些权限确保您不在pipe理帐户上进行testing，因为他们将无法更改pipe理用户的密码，因为他们受到属性adminCount = 1的保护。我已成功允许帮助台人员更改ADUC中的密码，并在用户OU上更改密码权限。 我们最终购买了一个产品，允许用户重置自己的密码。 我知道这不是完全回答你的问题，但我希望这些信息的一些帮助。
我已经注意到了这个问题：我testing的目标用户“osman”是一个域pipe理员，显然，域pipe理员不会inheritance委托（不知道为什么，没有logging，据我所知）。 所有其他非pipe理员工作得很好！ 感谢您的所有build议。