hi, i have to write a script to associate an external account to a
disabled ad user.
I have the following code.it gives me an error(-2147016657) in the
last line and i can't update "ntSecurityDescriptor" maybe because i
wrote in a bad way the addace call.
can anyone help me?

Set oSID = CreateObject("ADsSID")
oSID.SetAs 2, NTUser
RawSID = oSID.GetAs(0)
oUser.Put "msExchMasterAccountSID", RawSID
oUser.SetInfo

Set oSecurityDescriptor = oUser.MailboxRights
Set dacl = oSecurityDescriptor.DiscretionaryAcl
objSD = oUser.Get("ntSecurityDescriptor")
Set objDACL = objSD.DiscretionaryACL

AddAce dacl, NTUser, 131079, ADS_ACETYPE_ACCESS_ALLOWED,
ADS_ACEFLAG_INHERIT_ACE, 0, 0, 0
oSecurityDescriptor.DiscretionaryAcl = dacl
oUser.MailboxRights = oSecurityDescriptor
oUser.SetInfo

AddAce objDACL, NTUser, ADS_RIGHT_DS_CONTROL_ACCESS,
ADS_ACETYPE_ACCESS_ALLOWED_OBJECT, 0, 0,
"{ab721a54-1e2f-11d0-9819-00aa0040529b}", 0
objSD.DiscretionaryAcl = objDACL
oUser.Put "ntSecurityDescriptor", Array(objSD)
oUser.SetInfo