Can I get the objectsecurity property via ADODB query?

previously, asked how check via posh on "manager can update membership list" setting security groups.  graciously given workable solution via adsi.  using adsi grab managedobjects user , using adsi grab group objects list followed filter process on manager's update rights. 

i have since discovered faster adodb query process faster, i'm missing 1 property need.  can query groups particular managedby property:

$adocommand = new-object -comobject "adodb.command"  $adoconnection = new-object -comobject "adodb.connection"  $adoconnection.provider = "adsdsoobject"  $adoconnection.open("active directory provider")  $adocommand.activeconnection = $adoconnection  $sqlstring = "select name, distinguishedname, members '$($ldapaddress)' objectcategory='group' , managedby='$($userdname)'"  $adocommand.commandtext = $sqlstring  $adorecordset = $adocommand.execute()  

what don't know how filter groups manager allowed modify without resorting adsi solution (which requires requerying each group:

$adsiobj = new-object system.directoryservices.directorysearcher([adsi]"")  $adsiobj.filter = "(&(objectcategory=group)(distinguishedname=$($groupdname)))"  $group = $adsiobj.findone().getdirectoryentry()  $acl = $adobject.psbase.objectsecurity  $acl.getaccessrules($true,$true,[system.security.principal.securityidentifier]) | {$_.identityreference -eq $managedbysid}  

what i'm wondering can objects returned in adodb record set have psbase.objectsecurity property?  if so, additional property need request in sql string that?  if not, there better method?

thanks!

if understand correctly, want filter on entries in ntsecuritydescriptor attribute of objects. you cannot filter on this security object in such query. must bind each object , invoke method retrieve attribute object.

however, might able use get-acl cmdlet, don't know filter use.

---

richard mueller - mvp directory services

Windows Server  >  Windows PowerShell