Share via

Use DSACLs to delegate GP-Link and GP-Options on OU

Reese, Don 0 Reputation points
2025-06-19T00:33:47.8233333+00:00

Trying to figure out how to set a delegation against an OU for GP-Link and GP-Options. I'm close but I keep getting an error saying "no GUID found for {f30e3bbe-9ff0-11d1-b603-0000f80367c1}" The parameter is incorrect.

I've tried various combinations of single quote, doublequote, curly braces, etc.

$dom = Domain

$basepath = Domain root

DSACLS "OU=Clients, $basepath" /I:T /G "dlg_Clients_GroupPolicy:RPWP;{f30e3bbe-9ff0-11d1-b603-0000f80367c1}"

Windows for business | Windows Client for IT Pros | Directory services | Active Directory
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Geoff McKenzie 865 Reputation points
    2025-06-19T02:13:58.24+00:00

    Hi Don,
    I don't have access to my lab at the moment but here are a few options I would try....

    1. Set the GUID as a variable like you did with domain and base path
    2. use backtick (i.e. this character ` ) to escape the curly brackets any other special meaning characters
    3. Use the Ldap-Display-Name e.g. https://learn.microsoft.com/en-us/windows/win32/adschema/a-gplink
    4. Find someone else's script and see if you can adapt that e.g. https://gist.github.com/leobouard/027bbcc9941d80c8175cb337147fc0e4
    5. Call CMD.exe to run the DSACLS command

    Actually 4 should be 1 ....

    Good luck - I hope one of these helps.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.