LDAP, Active Directory, and permissions

Hi, I've found various sources and are successfully manipulating Active Directory from PHP on our Domain Controller - frankly, things works much better than I expected :) I have now reached the point where I need to set permissions on objects in Active Directory, i.e. to restrict read permissions to certain OUs and objects within the directory (mainly related to Exchange stuff). Is there anything in PHP which can be used to set permissions on AD objects? I haven't found any reference to doing this anywhere, so I thought I'd give it a chance here... If not, then I suppose I'll have to code some ..NET application to act as a gateway between the PHP interface and Active Directory, but naturally I would like to do as much as possible from within PHP itself. Many thanks, -- Regards, Chris Knipe