Can I use the JWSCL to check whether the current user has a specific extended right on an Active Directory object?

Question

[This is a slightly more specific version of the question I already asked here: How do I query effective permissions on an Active Directory Object? - Hopefully the answers I receive here will help me better understand and judge the answer(s) I received there.]

Very specifically, I'm currently looking for a way to verify whether the current user has the Exchange-specific "Send As" permission (this is a so-called "extended right") on a given Active Directory object such as another user (i.e. a mailbox), a mail-enabled Public Folder or a distribution list. It's important that permissions granted (or denied) indirectly via group membership are taken into account as well. In the mid- to long-term I'd very much like to learn more about the Windows security model and its APIs. This task is just my jumping-off point.

While researching how best to implement some of the available C++ examples in Delphi, I stumbled across the JWSCL (JEDI Windows Security Code Library). But even though it seems there have been recent contributions of some AD-related code, several documents on the JWSCL blog and wiki still note that "Active Directory support" has yet to be added.

However, could this maybe just be an issue of outdated documentation? And even if not, do I really need that for this particular task? I am already able to retrieve the SECURITY_DESCRIPTOR attribute of the objects I want to check using IDirectoryObject.GetAttributes. Once I've got that SD, does it still make a difference that I'm checking permissions on an AD object? Couldn't I just use that with the code that's already there despite the supposedly missing AD support?
If so, how?

I already tried modifying the GetEffectiveRightsFromAclWithAuthZ example that ships with the JWSCL but I already fail at creating a TJwSecurityDescriptor object from my PSECURITY_DESCRIPTOR pointer. Simply passing it to TJwSecurityDescriptor.Create() fails with an EJwsclInvalidSIDException.

Any ideas? Am I even remotely on the right track?

Intellectualism

@Remko: Please don't tell me it would make a difference! The minimum requirement is 2007 and 2010, but if possible: all the way back to 2000... – Intellectualism

Well usually the Exchange API's are used to do what you want which means CDOEXM for <= 2003 and PowerShell for >= 2007 – Outcurve

Did you check this link: gsexdev.blogspot.com/2005/12/… – Outcurve

@Outcurve : Thanks! That link was very useful indeed, e.g. I didn't know about the special handling required for "Extended Rights". However, the script quoted there only checks directly granted rights, not those inherited by group membership... – Intellectualism

Please note that I didn't actually test the script regarding the group check, but it looks like it simply parses the object's security descriptor. I had gotten to that point already (see https://mcmap.net/q/1229657/-how-do-i-query-effective-permissions-on-an-active-directory-object/9784) but bailed out when I found out that this way I would have had to also recurse through the group memberships... essentially that discovery was what prompted me to post here in the first place. – Intellectualism

let us continue this discussion in chat – Outcurve