You want to change the ACL on an object to grant or restrict access to it for a user or group.
220.127.116.11 Using a graphical user interface
18.104.22.168 Using a command-line interface
> dsacls <ObjectDN>
22.214.171.124 Using VBScript
See Recipe 7.7, Recipe 8.2, Recipe 13.6, and Recipe 17.9 for several examples of modifying an ACL with VBScript.
Changing the ACL of an object is a common task for administrators in any but the most basic AD implementations because, as shown in Recipe 14.5 and Recipe 14.6, the Delegation of Control Wizard is limited and cumbersome to extend and deploy. The GUI and command-line methods are useful for one-off changes to permissions, but for making global changes to a number of objects you should consider using a script.
14.10.4 See Also
MS KB 281146 (How to Use Dsacls.exe in Windows 2000)