This is the built-in help made by Microsoft for the command 'New-ADCentralAccessPolicy', in PowerShell version 5 - as retrieved from
Windows version 'Microsoft Windows Server 2012 R2 Standard' PowerShell help files on 2016-06-23.
For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.
Creates a new central access policy in Active Directory containing a set of central access rules.
New-ADCentralAccessPolicy [-Name] <String> [-AuthType {Negotiate | Basic}] [-Credential <PSCredential>] [-Description <String>] [-Instance <ADCentralAccessPolicy>]
[-PassThru] [-ProtectedFromAccidentalDeletion <Boolean>] [-Server <String>] [-Confirm] [-WhatIf] [<CommonParameters>]
The New-ADCentralAccessPolicy cmdlet creates a new central access policy in Active Directory. A central access policy in Active Directory contains a set of central access
rules.
<
Online Version: http://go.microsoft.com/fwlink/p/?linkid=291060
Get-ADCentralAccessPolicy
Remove-ADCentralAccessPolicy
Set-ADCentralAccessPolicy
<
-------------------------- EXAMPLE 1 --------------------------
PS C:\>$DepartmentResourceProperty = Get-ADResourceProperty -Identity Department
PS C:\> $ResourceCondition = "(@RESOURCE." + $DepartmentResourceProperty.Name + " Contains {`"Finance`"})"
PS C:\> New-ADCentralAccessRule -Name "Finance Documents Rule" -ResourceCondition $ResourceCondition
This example creates a new central access rule named Finance Documents Rule with a new resource condition. The resource condition scopes the resources to ones containing the
value Finance in their Department resource property.
-------------------------- EXAMPLE 2 --------------------------
PS C:\>$CountryClaimType = Get-ADClaimType -Identity Country
PS C:\> $DepartmentClaimType = Get-ADClaimType -Identity Department
PS C:\> $CountryResourceProperty = Get-ADResourceProperty -Identity Country
PS C:\> $DepartmentResourceProperty = Get-ADResourceProperty -Identity Department
PS C:\> $FinanceException = Get-ADGroup -Identity FinanceException
PS C:\> $FinanceAdmin = Get-ADGroup -Identity FinanceAdmin
PS C:\> $ResourceCondition = "(@RESOURCE." + $departmentResourceProperty.Name + " Contains {`"Finance`"})"
PS C:\> $CurrentAcl = "O:SYG:SYD:AR(A;;FA;;;OW)(A;;FA;;;BA)(A;;0x1200a9;;;" + $FinanceException.SID.Value + ")(A;;0x1301bf;;;" + $FinanceAdmin.SID.Value +
")(A;;FA;;;SY)(XA;;0x1200a9;;;AU;((@USER." + $CountryClaimType.Name + " Any_of @RESOURCE." + $CountryResourceProperty.Name + ") && (@USER." + $DepartmentClaimType.Name + "
Any_of @RESOURCE." + $DepartmentResourceProperty.Name + ")))"
PS C:\> Set-ADCentralAccessRule -Identity "Finance Documents Rule" -ResourceCondition $ResourceCondition -CurrentAcl $CurrentAcl
This example creates a new central access rule named Finance Documents Rule with a new resource condition and new permissions.
The new rule specifies that documents should only be read by members of the Finance department. Members of the Finance department should only be able to access documents in
their own country. Only Finance Administrators should have write access. The rule allows an exception for members of the FinanceException group. This group will have read
access.
Targeting:
-- Resource.Department Contains Finance
Access rules:
-- Allow Read User.Country=Resource.Country AND User.department = Resource.Department
-- Allow Full control User.MemberOf(FinanceAdmin)
-- Allow Read User.Country=Resource.Country AND User.department = Resource.DepartmentAllow Read User.MemberOf(FinanceException)
-------------------------- EXAMPLE 3 --------------------------
PS C:\>Get-ADCentralAccessPolicy -Identity "Finance Policy" | New-ADCentralAccessPolicy -Name "Human Resources Policy" -Description "For the Human Resources Department."
This example creates a new central access policy named Human Resources Policy using the property values from Finance Policy, and set the description to For the Human
Resources Department.