powershell - Setting Permissions for a user who hasn't propagated yet -

i'm trying set permissions folder in powershell. problem setting these permissions on active directory account created on 1 of our head domain controllers. since account brand new, hasn't propagated down of our local dcs yet. causing problem me, since trying set folder allow user have modify access , powershell tossing "some or identity references not translated." error when try call setaccessrule on folder's acl. example code shown below.

#i'm setting more details account, abbreviated #the command make little more readable new-aduser -name "testy testerson" -server master-dc.domain.ca  $directorylocation = '\\fileserver\somedirectory'  new-item "filesystem::$directorylocation" -itemtype directory  $aclneedingmodification = get-acl "filesystem::$directorylocation"  $newaclrule = new-object system.security.accesscontrol.filesystemaccessrule('domain\testy testerson', 'modify', 'allow')  $aclneedingmodification.setaccessrule($newaclrule) #error occurs here  set-acl "filesystem::$directorylocation" $aclneedingmodification 

now, guess hodgepodge solution using sid of user instead , jamming in , waiting propagation complete link. being said, i'd vastly prefer find way allow me tell setaccessrule method @ specific dc, similar ad commands. documentation setaccessrule pretty sparse on how resolution occurs, wondering if on here had better way accomplish i'm trying do.

thanks bunch looking!

take @ powershell: script failing because ad objects have not replicated enough. i'm having same problem , i'll try figure out on next few days. if find useful, i'll update answer. http://ss64.com/ps/set-addomainmode.html may useful i'm not sure yet.

edit: wrote cmdlet waits ad object propagate domain controllers.

<# .synopsis     wait ad object propagate domain controllers.  .description     cmdlet enumerates domain controllers in current domain ,     polls each 1 in turn until specified object exists on each one. if     object doesn't propagate inside timeout time span,     cmdlet throw system.timeoutexception.  .parameter ldapfilter     ldap filter used locate object.  .parameter timeout     time span command should wait before timing out.  .notes     author: alex barbur <alex@barbur.net> #> function wait-adobject {     [cmdletbinding(supportsshouldprocess=$true)]     param     (     [parameter(mandatory=$true)]     [string]$ldapfilter,     [timespan]$timeout = '00:00:30'     )      # calculate when should stop     $stop = $(get-date) + $timeout     write-verbose "will check until $stop"      # iterate through domain controllers     $domain = get-addomain     foreach ($server in $domain.replicadirectoryservers)     {         # wait object replicate         write-verbose "checking $server"          $object = $null         while($object -eq $null)         {             # check if we've timed out             $left = new-timespan $(get-date) $stop             if($left.totalseconds -lt 0)             {                 # timeout                 throw [system.timeoutexception]"object propagation has timed out."             }              # wait bit , check again             start-sleep -milliseconds 250             $object = get-adobject -ldapfilter $ldapfilter -server $server         }     } } 

and can use this.

import-module activedirectory new-aduser -samaccountname 'doe.1' wait-adobject -ldapfilter '(samaccountname=doe.1)' 

hopefully it's useful someone.