title: SET-ACL via powershell for computer object
body: <p>i am trying to modify a permission to multiple computers in my domain so that they are allowed to authenticate cross domain.</p>
  
  <p>My code is simple however i keep getting an error.</p>
  
  <pre><code>Function Add-ADGroupACL
  {
      param([string]$Computername,[string]$Access)
      #Get a reference to the RootDSE of the current domain
      $rootdse = Get-ADRootDSE
      #Get a reference to the current domain
      $domain = Get-ADDomain
      #Create a hashtable to store the GUID value of each extended right in the forest
  $extendedrightsmap = @{}
  Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter `
  "(&amp;(objectclass=controlAccessRight)(rightsguid=*))" -Properties displayName,rightsGuid | 
  % {$extendedrightsmap[$_.displayName]=[System.GUID]$_.rightsGuid}
  
  #Create a hashtable to store the GUID value of each schema class and attribute
  $guidmap = @{}
  Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter `
  "(schemaidguid=*)" -Properties lDAPDisplayName,schemaIDGUID | 
  % {$guidmap[$_.lDAPDisplayName]=[System.GUID]$_.schemaIDGUID}
  
      #Get the computer  object for modification on
      $Computer = Get-ADComputer -Identity $Computername
  
      #get the SID of the group you wish to add to the computer.
      $GroupIdentity = New-Object System.Security.Principal.SecurityIdentifier(Get-ADGroup -Identity $Access).SID
  
      $computersADPath = "AD:\" + $Computer.DistinguishedName
      $ComputerACL = Get-ACL $computersADPath
  
      #Create a new rule to add to the object
      $newAccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
          $GroupIdentity,"ExtendedRight",
          "Allow", 
          $extendedrightsmap["Allowed To Authenticate"],
          "None")
  
      $newAccessRule
      #Add the rule to the ACL
      $ComputerACL.AddAccessRule($newAccessRule)
      #Set Rules to the ACL
      Set-Acl -AclObject $ComputerACL -Path $computersADPath
  }
  </code></pre>
  
  <p>I have posted the entire function to make it easy.
  Simply call this as so</p>
  
  <pre><code>Add-ADGroupACL -Computername 'TestComputer' -Access 'TestGroup'
  </code></pre>
  
  <p>end here is the error message that i keep getting</p>
  
  <blockquote>
    <p>Set-Acl : This security ID may not be assigned as the owner of this object
    At line:88 char:5
    +     Set-Acl -AclObject $ComputerACL -Path $computersADPath
    +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : NotSpecified: (CN=testComputer,OU=Co...C=subdomain,DC=domain:String) [Set-Acl], ADException
        + FullyQualifiedErrorId : ADProvider:SetSecurityDescriptor:ADError,Microsoft.PowerShell.Commands.SetAclCommand</p>
  </blockquote>
  
  <p>The Access Rule looks right. it shows this.</p>
  
  <pre><code>ActiveDirectoryRights : ExtendedRight 
  InheritanceType       : None
  ObjectType            : 68b1d179-0d15-4d4f-ab71-46152e79a7bc
  InheritedObjectType   : 00000000-0000-0000-0000-000000000000
  ObjectFlags           : ObjectAceTypePresent 
  AccessControlType     : Allow
  IdentityReference     : S-1-5-21-2926237862-3770063950-2320700579-361721 
  IsInherited       : False 
  InheritanceFlags      : None 
  PropagationFlags      : None
  </code></pre>
  
  <p>Any help would be greatly appreciated.
  Thank you.</p>