AD: Objektverwaltung zuweisen - User - employeeID

dsacls "OU=Verwaltung,DC=domain,dc=tld" /I:S /G "DOMAIN\MaxMustermann:WPRP;employeeID;user"

function Delegate-ADProperty {
    param(
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][ValidateScript({Get-ACL "AD:$_"})][string]$ObjectDN,  
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][System.Security.Principal.IdentityReference]$Account,
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][string]$Attribute,
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][string]$InheritingObjects,
        [Parameter()][System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance]::Descendents,
        [Parameter(mandatory=$true)][ValidateNotNullOrEmpty()][string]$AccessRights,
        [Parameter()][ValidateSet("Allow","Deny")][string]$AccessControlType = "Allow"  

    )
    # get attribute GUID
    $GUID_ATTRIBUTE = (Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -Filter "ldapDisplayName -eq '$Attribute' -and objectClass -eq 'attributeSchema'" -Properties schemaIDGUID).schemaIDGUID -as [guid]  
    if ($GUID_ATTRIBUTE -eq $null){
        Write-Error -Message "Attribute '$Attribute' could not be found." -Category InvalidArgument  
        return
    }
    # get class GUID of inheriting objects
    $GUID_CLASS = (Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -Filter "ldapDisplayName -eq '$InheritingObjects' -and objectClass -eq 'classSchema'" -Properties schemaIDGUID).schemaIDGUID -as [guid]  
    if ($GUID_CLASS -eq $null){
        Write-Error -Message "Inheriting Object Class Name '$InheritingObjects' could not be found." -Category InvalidArgument  
        return
    }
    
    # get acl of AD object
    $acl = Get-ACL "AD:$ObjectDN"  
    
    # create AccesRule
    $rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule ($Account,$AccessRights,$AccessControlType,$GUID_ATTRIBUTE,$inheritanceType,$GUID_CLASS) -ErrorAction Stop
    # Add rule to acl
    $acl.AddAccessRule($rule)
    # save acl to object
    Set-ACL "AD:$ObjectDN" $acl  
    return $rule
}


Delegate-ADProperty -ObjectDN 'OU=Verwaltung,DC=domain,dc=tld' -Account ([System.Security.Principal.NTAccount]"MaxMustermann") -Attribute "employeeID" -InheritingObjects 'user' -AccessRights "ReadProperty,WriteProperty" -AccessControlType Allow -InheritanceType Descendents