Allow multiple OU's for Delegation of Control

scripts/ADDS/payload/scripts/01.Organizational units.yml

@@ -7,6 +7,8 @@ OrganizationalUnits:
   Description: ''
 - DistinguishedName: OU=Laptops,OU=Clients,OU=Computer accounts
   Description: ''
+- DistinguishedName: OU=Kiosks,OU=Clients,OU=Computer accounts
+  Description: ''
 - DistinguishedName: OU=Servers,OU=Computer accounts
   Description: ''
 

scripts/ADDS/payload/scripts/04.Delegation of Control.ps1

@@ -65,21 +65,29 @@ If (@('primary','standalone') -contains $Parameter['deployment.type']) {
     $GUIDMap['null'] = [Guid]::Empty
 
     ForEach ($Entry in $Delegations.DelegationEntries) {
-        $GetADObjectSplat = @{
-            Identity = $Entry.OrganizationalUnit + (($Parameter['addsconfig.domainname'] -split '\.' | ForEach-Object {',DC={0}' -f $_}) -join '')
-        }
-        $OU = Get-ADObject @GetADObjectSplat
-        $GetACLSPlat = @{
-            Path = "$($PSDrive.Name):\$($OU.DistinguishedName)"
-        }
-        $ACL = Get-ACL @GetACLSPlat
-
         $GetADObjectSplat = @{
             Filter = "sAMAccountName -eq '$($Entry.Principal)'"
             Properties = 'objectSID'
         }
         $Principal = Get-ADObject @GetADObjectSplat
 
+        ForEach ($OU in $Entry.OrganizationalUnit) {
+            $GetADObjectSplat = @{
+                Identity    = ($OU + (',{0}' -f (Get-ADRootDSE).rootDomainNamingContext))
+                ErrorAction = 'SilentlyContinue'
+            }
+            $OU = Get-ADObject @GetADObjectSplat
+            If ([boolean]$OU) {
+                $GetACLSPlat = @{
+                    Path = "$($PSDrive.Name):\$($OU.DistinguishedName)"
+                }
+                $ACL = Get-ACL @GetACLSPlat
+            }
+            Else {
+                # Respective OU was not found in Active Directory; skipping permission assignment
+                Continue
+            }
+
             ForEach ($Rule in $Entry.AccessRules) {
                 If ($Rule.ObjectType -eq '') {
                     $Rule.ObjectType = 'null'
@@ -112,6 +120,7 @@ If (@('primary','standalone') -contains $Parameter['deployment.type']) {
             }
             Set-Acl @SetAclSplat
         }
+    }
 
     If ([boolean]($PSDrive.Name -eq 'ADDS') -eq $True) {
         $RemovePSDriveSplat = @{

scripts/ADDS/payload/scripts/04.Delegation of Control.yml

@@ -1,6 +1,8 @@
 DelegationEntries:
-- Principal: admJaneD
+- Principal: admJaneD                                # Entries will be concatenated with ',DC=<example>,DC=<org>' automatically
-  OrganizationalUnit: CN=Computers                   # Entries will be concatenated with ',DC=<example>,DC=<org>' automatically
+  OrganizationalUnit:
+  - CN=Computers
+  - OU=Kiosks,OU=Clients,OU=Computer accounts
   AccessRules:
   - ActiveDirectoryRights: Self                      # A combination of one or more of the ActiveDirectoryRights enumeration values that specifies the rights of the access rule.
     AccessControlType: Allow                         # One of the AccessControlType enumeration values that specifies the access rule type.
@@ -48,7 +50,8 @@ DelegationEntries:
     ObjectType: Computer
     InheritedObjectType: ''
 - Principal: admJaneD
-  OrganizationalUnit: OU=Clients,OU=Computer accounts
+  OrganizationalUnit:
+  - OU=Clients,OU=Computer accounts
   AccessRules:
   - ActiveDirectoryRights: CreateChild, DeleteChild
     AccessControlType: Allow