How to grant SELF to access template with new-qarsaccesstemplatelink

I am looking for the syntax or if it's even possible to use the NEW-QARSAccessTemplateLink powershell to apply with a trustee of "nt authority\self".  I need to apply some permissions in AD and we prefer to do it all with ARS and sync them to AD so we can easily go into ARS and turn them off (remove the template link) when no longer needed.  I have the below syntax as i use this command quite often but the trustee has always been a group in the domain not the built in SELF up until now.  The error it's throwing is  

+ CategoryInfo : NotSpecified: (:) [New-QARSAccessTemplateLink], InvalidPathnameException
+ FullyQualifiedErrorId : ActiveRoles.ManagementShell.DirectoryAccess.InvalidPathnameException,ActiveRoles.ManagementShell.Powershell.Cmdlets.NewATLinkCmdlet


New-QARSAccessTemplateLink -AccessTemplate "CN=Access Template I am applying,CN=Access Templates,CN=Configuration" -DirectoryObject "OU=OUWhereComputersLive,DC=Domain,DC=com" -Trustee 'NT AUTHORITY\SELF' -proxy -SynchronizedToAD $true

I also tried "SELF" both with and without quotes but due to users in the domain with SELF as a last name, i get Ambiguous identity: SELF.

Using the MMC, i can apply the template no issues to SELF but i have a few hundred to update so powershell would be easiest.  We also use a script when we bring up new sites and create the OUs for that site which would need these so applying them via powershell would allow for us to keep it stream lined.  Any assistance would be appreciated.

  • It took me a bit of trial and error but i figured this out and wanted to post the answer in case anyone else needs it in the future.  The SELF is a principal and the DN for it is below, once i found that by using Get-QADObject, using the Below DN allowed powershell to apply the template link

    CN=Self,CN=WellKnown Security Principals,CN=Configuration,DC=xxxxxx,DC=com