There are some delegations of permissions within Active Directory which cannot be made without extra effort. Some properties are flagged as hidden in a file called Dssec.dat, in %windir%\System32 on computers with the Active Directory Users and Computers (ADUC) MMC. Dssec.dat is a hidden text file that can be viewed and modified with Notepad. When you open Dssec.dat, you’ll notice that it’s divided into headings based on object class. Be sure to go to the [User] heading to make changes. Otherwise, you won’t see any effect on the GUI display. For example, to show the PhysicalDeliveryOfficeName and other properties in the GUI, change the Dssec.dat value from 7 to 0 and save the changes. For more, see: https://mcpmag.com/articles/2003/11/01/finetuning-active-directory-access.aspx. Note too, that you can use delegwiz.inf for custom delegations.
If you need to copy the delegations to apply over many OUs within a domain this can be cumbersome. You have to copy the modified dssec.dat or delegwiz.inf to each systems running the ADUC. If you choose to simply go with a modified dssec.dat file select the right combination of permissions can be difficult. Here is my solution:
1) Run the export script, Export-SelectedOUPermissions.ps1, selecting domain and path which has the permissions you want to copy.
2) Optionally edit the permissions files to change the Identity Reference — the user or group to get the permissions.
3) Run the import script, Import-SelectedOUPermissions.ps1, select domain and destination(s). You can use the graphical list to put checkboxes beside your selections.
If you are running the import script from within the ISE, the editor will be temporarily minimized to make sure you can see the menus. You really should run the script in test mode first, and apply your delegation to a test OU before running in production. Because Set-ACL often fails outside of the local domain with a “server refused” error, I used the .NET ObjectSecurity.SetSecurityDescriptorSddlForm method to apply the changes.
Recently an admin accidentally removed a complex delegation from an OU at 4:00 pm. We were able to copy the delegation from another source and have the site back up and running within 10 minutes.