使用PowerShell的ActiveDirectoryAccessRule时遇重载找不到错误

你遇到的错误是因为调用System.DirectoryServices.ActiveDirectoryAccessRule时使用了不存在的5参数重载，且参数类型/顺序不符合要求。以下是修正后的脚本及关键说明：

修正后的PowerShell脚本 #

function Set-KeyCredentialLinkPermissions {
    param (
        [Parameter(Mandatory = $true)]
        [string] $groupName,

        [Parameter(Mandatory = $true)]
        [string] $userToAdd
    )

    # Add the user to the group
    try {
        Add-ADGroupMember -Identity $groupName -Members $userToAdd
        Write-Output "$userToAdd was successfully added to the $groupName group."
    } catch {
        Write-Error "An error occurred while adding the user to the group: $_"
        return
    }

    # Get the DistinguishedName of the AdminSDHolder object
    $adminSDHolderDN = (Get-ADObject -Filter { Name -eq "AdminSDHolder" } -Properties DistinguishedName).DistinguishedName

    try {
        # Connect to the AdminSDHolder object
        $adsi = [ADSI]"LDAP://$adminSDHolderDN"

        # Get the ObjectSID of the group and convert to IdentityReference
        $groupSID = (Get-ADGroup -Identity $groupName -Properties ObjectSID).ObjectSID
        $identityReference = [System.Security.Principal.IdentityReference]$groupSID

        # GUID for msDS-KeyCredentialLink attribute
        $guidKeyCredentialLink = [guid]"2f68b1d6-f5ae-4cb6-b34f-8108b3409d6b" # msDS-KeyCredentialLink GUID

        # Get the current ACL
        $acl = $adsi.ObjectSecurity

        # Optionally clear existing rules (to leave only msDS-KeyCredentialLink permissions)
        $acl.Access | Where-Object { $_.IdentityReference -eq $identityReference } | ForEach-Object {
            $acl.RemoveAccessRule($_)
        }

        # Create new access rules - 使用正确的构造函数重载
        # 重载格式：IdentityReference, ActiveDirectoryRights, AccessControlType, Guid, ActiveDirectorySecurityInheritance
        $writeRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
            $identityReference, 
            [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty, 
            [System.Security.AccessControl.AccessControlType]::Allow,
            $guidKeyCredentialLink,
            [System.DirectoryServices.ActiveDirectorySecurityInheritance]::Descendants
        )

        $readRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
            $identityReference, 
            [System.DirectoryServices.ActiveDirectoryRights]::ReadProperty, 
            [System.Security.AccessControl.AccessControlType]::Allow,
            $guidKeyCredentialLink,
            [System.DirectoryServices.ActiveDirectorySecurityInheritance]::Descendants
        )

        # Set general read permission (for descendant user objects) - 使用不带属性GUID的重载
        $readAllRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
            $identityReference, 
            [System.DirectoryServices.ActiveDirectoryRights]::GenericRead, 
            [System.Security.AccessControl.AccessControlType]::Allow,
            [System.DirectoryServices.ActiveDirectorySecurityInheritance]::Descendants
        )

        # Add access rules and commit changes
        $acl.AddAccessRule($writeRule)
        $acl.AddAccessRule($readRule)
        $acl.AddAccessRule($readAllRule)
        $adsi.ObjectSecurity = $acl
        $adsi.CommitChanges()

        Write-Output "Permissions for msDS-KeyCredentialLink were successfully set on the AdminSDHolder object."
    } catch {
        Write-Error "An error occurred while setting msDS-KeyCredentialLink permissions on the AdminSDHolder object: $_"
    }
}

# Run the function
Set-KeyCredentialLinkPermissions -groupName "Key Admins" -userToAdd "octo"

关键修正点 #

• IdentityReference类型转换：原来的$groupSID.Value是字符串类型，构造函数需要的是System.Security.Principal.IdentityReference对象，直接转换$groupSID即可（因为ObjectSID本身就是SecurityIdentifier类型，继承自IdentityReference）。
• 构造函数参数顺序调整：当需要指定特定属性的权限时，正确的重载参数顺序是IdentityReference, ActiveDirectoryRights, AccessControlType, Guid, ActiveDirectorySecurityInheritance，你之前把继承类型放在了属性GUID前面，导致参数不匹配，调整顺序后即可匹配正确的重载。
• 通用读取权限的构造函数：对于不需要指定特定属性的通用读取权限，使用不带属性GUID的重载，参数数量为4，避免传递空GUID导致的错误。

内容的提问来源于stack exchange，提问作者Yunus Emre SARITOPRAK