Script repository

# Bind to the OU where the target object is located
$parent = $Context.BindToObject($Context.TargetObject.Parent)

# Get parent OU owner
$Context.ConditionIsMet = $True
try
{
    $ownerDN = $parent.Get("managedBy")
}
catch
{
    $Context.ConditionIsMet = $False
}

# Check whether initiator is the owner
if ($ownerDN -eq "%adm-InitiatorDN%")
{
    return
}

# Check whether owner is a group
$owner = $Context.BindToObjectByDN($ownerDN)

if ($owner.Class -ne "group")
{
    $Context.ConditionIsMet = $False
    return
}

# Get group members
try
{
    $memberGuidsBytes = $owner.GetEx("adm-MembersGuid")
}
catch
{
    $Context.ConditionIsMet = $False
    return
}

# Check whether initiator is a member of the group
$initiatorGuid = [Guid]"%adm-InitiatorGuid%"
foreach ($guidBytes in $memberGuidsBytes)
{
    $guid = [Guid]$guidBytes
    if ($guid -ne $initiatorGuid)
    {
        continue
    }
    
    # Initiator is a member of the group that owns the OU
    return
}