This is the built-in help made by Microsoft for the command 'New-ADCentralAccessPolicy', in PowerShell version 3 - as retrieved from
Windows version 'Microsoft Windows Server 2012 Standard' PowerShell help files on 2016-06-23.
For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.
Creates a new central access policy in Active Directory containing a set of central access rules.
New-ADCentralAccessPolicy [-Name] <String> [-AuthType <ADAuthType>] [-Credential <PSCredential>] [-Description <String>] [-Instance
<ADCentralAccessPolicy>] [-PassThru [<SwitchParameter>]] [-ProtectedFromAccidentalDeletion <Boolean>] [-Server <String>] [-Confirm
[<SwitchParameter>]] [-WhatIf [<SwitchParameter>]] [<CommonParameters>]
The New-ADCentralAccessPolicy cmdlet creates a new central access policy in Active Directory. A central access policy in Active Directory
contains a set of central access rules.
<
Online Version: http://go.microsoft.com/fwlink/?LinkId=216373
<
-------------------------- EXAMPLE 1 --------------------------
C:\PS>$departmentResourceProperty = Get-ADResourceProperty Department
$resourceCondition = "(@RESOURCE." + $departmentResourceProperty.Name + " Contains {`"Finance`"})"
New-ADCentralAccessRule "Finance Documents Rule" -ResourceCondition $resourceCondition
Description
-----------
Create a new central access rule named "Finance Documents Rule" with a new resource condition. The resource condition scopes the resources to
ones containing the value 'Finance' in their 'Department' resource property.
-------------------------- EXAMPLE 2 --------------------------
C:\PS>$countryClaimType = Get-ADClaimType Country;
$departmentClaimType = Get-ADClaimType Department;
$countryResourceProperty = Get-ADResourceProperty Country;
$departmentResourceProperty = Get-ADResourceProperty Department;
$financeException = Get-ADGroup FinanceException;
$financeAdmin = Get-ADGroup FinanceAdmin;
$resourceCondition = "(@RESOURCE." + $departmentResourceProperty.Name + " Contains {`"Finance`"})"
$currentAcl = "O:SYG:SYD:AR(A;;FA;;;OW)(A;;FA;;;BA)(A;;0x1200a9;;;" + $financeException.SID.Value + ")(A;;0x1301bf;;;" +
$financeAdmin.SID.Value + ")(A;;FA;;;SY)(XA;;0x1200a9;;;AU;((@USER." + $countryClaimType.Name + " Any_of @RESOURCE." +
$countryResourceProperty.Name + ") && (@USER." + $departmentClaimType.Name + " Any_of @RESOURCE." + $departmentResourceProperty.Name + ")))";
Set-ADCentralAccessRule "Finance Documents Rule" -ResourceCondition $resourceCondition -CurrentAcl $currentAcl
Description
-----------
Create a new central access rule named "Finance Documents Rule" with a new resource condition and new permissions.
The new rule specifies that documents should only be read by members of the Finance department. Members of the Finance department should only
be able to access documents in their own country. Only Finance Administrators should have write access. The rule allows an exception for
members of the FinanceException group. This group will have read access.
Targeting:
Resource.Department Contains Finance
Access rules:
Allow Read User.Country=Resource.Country AND User.department = Resource.Department
Allow Full control User.MemberOf(FinanceAdmin)
Allow Read User.Country=Resource.Country AND User.department = Resource.DepartmentAllow Read User.MemberOf(FinanceException)
-------------------------- EXAMPLE 3 --------------------------
C:\PS>Get-ADCentralAccessPolicy "Finance Policy" | New-ADCentralAccessPolicy "Human Resources Policy" -Description "For the Human Resources
Department."
Description
-----------
Create a new central access policy named "Human Resources Policy" using the property values from 'Finance Policy', and set the description to
"For the Human Resources Department."