Insufficient access rights to perform the operation — Powershell

Question

I am writing a simple script to copy AD group membership from one user to the other. I am doing it using the ActiveDirectory module only.

The script looks like it would work and does work up until I try to ad the groups to the user.

Code:

import-module ActiveDirectory
$templateUser = get-ADUser user1
$targetUser = getADUser user2

$groups =get-adprincipalgroupmembership $templateUser
$groups2 = get-ADPrincipalGroupMembership $targetUser

foreach($group in $groups) {
    add-adGroupMember $group $targetUser
}

Error:

Add-ADGroupMember : insufficient access rights to performt the operation
At line:9 char:18
+ FullyQualifiedErrorID : Insufficient access rights to perform the operation,Microsoft.ActiveDirectory.Management.Commands.AddADGroupMember

Notes/Thoughts:

I am logged in as a normal user, but I ran the powershell as a different user (my admin account). I am not a local admin, but I am an admin on the domain. I am able to add the user to groups if I launch the AD Tools and do it manually (I have permissions to add to those groups).

Edit:

Run the powershell as admin.

Answer 1

以管理员身份运行powershell。

Answer 2

I hit this today in Server 2012. I was running the powershell as Administrator, I was a domain admin, I was a local admin, I was every kind of admin I could find.

I "fixed" it by using the Active Directory Users and Computers tool, adding myself as the Manager of the AD groups I was trying to add users to, and ticked the box to allow the manager to change membership. I could then run AD-AddGroupMember happily.

Answer 3

I ran into this problem as well using Powershell remoting to connect to a domain controller.

In my case it turned out Include inheritable permissions from this object's parent was turned off for the specific object I couldn't change.

Answer 4

I ran into this issue today where an automated system was using powershell scripts for various things.... It turned out to be executionpolicy. We were running our script with the ExecutionPolicy Bypass flag, and even running the command directly in powershell outside of a script wouldn't work, but once we set executionpolicy to unrestricted, everything magically worked.

For us we were able to create security groups even, but not add users to groups via powershell, even though we could make the same changes in ADUC.