windows-server-2003 – Active Directory 2003 – 删除委派的权

我在OU：Groups / Admin / Delegated Permissions中创建了一个AD组：g.Temp_DomainAdmin.

我有一个运行VBScript的计划任务,以从该组中删除所有用户.

该任务作为服务帐户运行,具有有限的权限：s.purge_temp_da

我已将OU的权限委派给服务帐户,以允许完全控制其下的组.

手动运行任务非常有效.但无论何时在午夜运行,它都会失败并显示“-2147024891 – 一般访问被拒绝错误”.查看g.Temp_DomainAdmin组会显示委派的权限已消失.

有任何想法吗？这是VBScript：

Option Explicit
Dim objRootDSE,strDomain,objGroup,objUser,strdistinguishedName,arrDnComponents
Const ADS_PROPERTY_DELETE = 4
' Retrieve domain information
Set objRootDSE = GetObject("LDAP://RootDSE")
strDomain = objRootDSE.Get("DefaultNamingContext")
' Bind to the group
Set objGroup = GetObject("LDAP://CN=G.ADM.Temp_DomainAdmin,OU=Delegated Permissions,OU=Admin,OU=Resource Access,OU=groups," & strDomain)

' Iterate through the user objects in the group
For Each objUser In objGroup.Members

    on error resume next

    ' Get the users distinguishedName
    strdistinguishedName = objUser.distinguishedName
    wscript.echo "Removing " & objUser.cn

    ' Remove the user from the group
    objGroup.PutEx ADS_PROPERTY_DELETE,"member",Array(strdistinguishedName)
    objGroup.SetInfo
    wscript.echo "Removed " & objUser.cn

    if err.number <> 0 then
        wscript.echo err.number & " - " & err.description
    end if

    on error goto 0
Next
wscript.echo "Done"

谢谢