执行Set-SpnPermission脚本时遇CommitChanges约束违反错误求助

运行你提供的Set-SpnPermission函数时，调用CommitChanges()触发“约束冲突”异常，可从以下几个方向排查修复：

1. 检查目标对象的权限继承状态 #

如果目标AD对象禁用了权限继承，直接添加访问控制条目（ACE）可能触发约束。执行以下命令查看继承状态：

$TargetObject.psbase.ObjectSecurity.AreAccessRulesProtected

若返回$true，说明权限继承被阻断。需确认是否允许修改该对象的继承设置，或调整继承后再添加规则。

2. 避免重复添加相同权限规则 #

若目标对象已存在完全匹配的ACE（相同身份、权限、属性GUID、允许类型），重复添加会触发约束。添加前先检查现有规则：

$existingRules = $TargetObject.psbase.ObjectSecurity.GetAccessRules($true, $true, [Security.Principal.IdentityReference])
$matchingRule = $existingRules | Where-Object { 
    $_.IdentityReference -eq $Identity -and 
    $_.ActiveDirectoryRights -eq $adRight -and 
    $_.ObjectType -eq $spnSecGuid
}

如果存在匹配规则，可跳过添加或先移除旧规则再更新。

3. 调整权限规则的继承范围 #

AD架构对Service-Principal-Name属性的权限设置可能有默认约束，尝试修改ActiveDirectoryAccessRule的继承参数：
将原构造函数中的"None"替换为"All"（根据目标对象类型调整）：

$accessRuleArgs = $identity,$adRight,"Allow",$spnSecGuid,"All"

4. 验证运行账户的权限 #

执行脚本的账户需要拥有修改目标AD对象权限的权限（如“修改权限”或“完全控制”）。权限不足也可能触发约束类错误，可切换到域管理员账户测试，或用whoami /priv查看当前账户权限。

优化后的函数示例 #

添加重复规则检查后的版本：

Function Set-SpnPermission {
    param(
        [adsi]$TargetObject,
        [Security.Principal.IdentityReference]$Identity,
        [switch]$Write,
        [switch]$Read
    )
    if(!$write -and !$read){
        throw "Missing either -read or -write"
    }
    $rootDSE = [adsi]"LDAP://RootDSE"
    $schemaDN = $rootDSE.psbase.properties["schemaNamingContext"][0]
    $spnDN = "LDAP://CN=Service-Principal-Name,$schemaDN"
    $spnEntry = [adsi]$spnDN
    $spnSecGuid = [GUID]$spnEntry.psbase.Properties["schemaIDGUID"][0]

    $adRight = [DirectoryServices.ActiveDirectoryRights]::None
    if($read) { $adRight = $adRight -bor [DirectoryServices.ActiveDirectoryRights]::ReadProperty }
    if($write) { $adRight = $adRight -bor [DirectoryServices.ActiveDirectoryRights]::WriteProperty }

    # 检查是否已存在匹配规则
    $existingRules = $TargetObject.psbase.ObjectSecurity.GetAccessRules($true, $true, [Security.Principal.IdentityReference])
    $matchingRule = $existingRules | Where-Object { 
        $_.IdentityReference -eq $Identity -and 
        $_.ActiveDirectoryRights -band $adRight -eq $adRight -and 
        $_.ObjectType -eq $spnSecGuid -and
        $_.AccessControlType -eq [Security.AccessControl.AccessControlType]::Allow
    }

    if(-not $matchingRule) {
        $spnAce = New-Object DirectoryServices.ActiveDirectoryAccessRule(
            $Identity, $adRight, [Security.AccessControl.AccessControlType]::Allow, 
            $spnSecGuid, [DirectoryServices.ActiveDirectorySecurityInheritance]::None
        )
        $TargetObject.psbase.ObjectSecurity.AddAccessRule($spnAce)
        $TargetObject.psbase.CommitChanges()    
        return $spnAce
    } else {
        Write-Host "Matching SPN permission rule already exists for $Identity"
        return $matchingRule
    }
}

内容的提问来源于stack exchange，提问作者shubu