How do you audit changes to delegation in ARS

As Aidar noted, there are two layers to this:

1) A new member getting added to a trustee group that is allowed to manage groups. This is easy to trap with a workflow that looks for a group membership change
2) Create of a new access template link granting a trustee group the ability to manage groups.

Below is some sample code to achieve trapping the creation of a new access template link.

(You would need to link this post create handler to this container: CN=AT Links,CN=Configuration)

Function OnPostCreate ($Request)
{

If ($Request.class -ne 'edsACE') {return}

# Store the initiator of the delegation

$Request.whoami([ref]$InitiatorSam,[ref]$InitiatorDN)

Get-QARSAccessTemplateLink -proxy -Identity $Request.GUID | select directoryobjectdn,trustee,accesstemplate | %{

# Add the initiator info to the details we obtained about the delegation link

$_ | Add-Member -MemberType NoteProperty -Name Initiator -Value $InitiatorDN

# Send all the details to a log file

$_ | export-csv "C:\scripting\Detect_Delegation\Delegations_Log.txt" -NoTypeInformation -Append

}

}

As Aidar noted, there are two layers to this:

1) A new member getting added to a trustee group that is allowed to manage groups. This is easy to trap with a workflow that looks for a group membership change
2) Create of a new access template link granting a trustee group the ability to manage groups.

Below is some sample code to achieve trapping the creation of a new access template link.

(You would need to link this post create handler to this container: CN=AT Links,CN=Configuration)

Function OnPostCreate ($Request)
{

If ($Request.class -ne 'edsACE') {return}

# Store the initiator of the delegation

$Request.whoami([ref]$InitiatorSam,[ref]$InitiatorDN)

Get-QARSAccessTemplateLink -proxy -Identity $Request.GUID | select directoryobjectdn,trustee,accesstemplate | %{

# Add the initiator info to the details we obtained about the delegation link

$_ | Add-Member -MemberType NoteProperty -Name Initiator -Value $InitiatorDN

# Send all the details to a log file

$_ | export-csv "C:\scripting\Detect_Delegation\Delegations_Log.txt" -NoTypeInformation -Append

}

}