Re: Delegation Control

From: Joe Richards [MVP] (humorexpress_at_hotmail.com)
Date: 10/03/04 

Date: Sun, 03 Oct 2004 12:23:16 -0400

lockoutTime is for locked out accounts, not disabled accounts. Disabling is
handled through a single bit flag in the useraccountcontrol attribute. Note that
allowing access to this allows more than just enabling/disabling accounts, they
can also set the password to never expire, etc. 

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net
Jerrald Noland wrote:
> Hi:
> 
> First, let me explain what I'm trying to do.  I want to setup a particular 
> group with the right to be able to reset user passwords and enable user 
> accounts.  Now, currently, I'm attempting to do this with the Delegation 
> Control Wizard.  The reset password option is working, but I'm unable to get 
> the enable account portion of this to work.  I've even printed out a 
> Microsoft KB article that I thought was related to this problem (KB Article 
> 294952).  I've done all the steps that the article says to do.  I've modified 
> the DSSEC.DAT file accordingly.  I've went in to the Delegation Control 
> Wizard and checked on the ReadLockOutTime and WriteLockOutTime boxes.  Still 
> not able to enable any user accounts.  Is there something else I need to do 
> that I'm overlooking or is this just not possible for users other than those 
> that have Admin priviledges?

Relevant Pages

  • Re: Delegation Control
    ... > allowing access to this allows more than just enabling/disabling accounts, ... >> group with the right to be able to reset user passwords and enable user ... >> Control Wizard. ... I've went in to the Delegation Control ...
    (microsoft.public.win2000.security)
  • Delegation Control
    ... group with the right to be able to reset user passwords and enable user ... Control Wizard. ... I've went in to the Delegation Control ... not able to enable any user accounts. ...
    (microsoft.public.win2000.security)
  • Re: Disabled Account [WILDPACKET]
    ... Well, I'm not saying that disabled accounts can't receive e-mail period, I'm ... I'll check with POSTINI. ...
    (microsoft.public.exchange.admin)
  • Re: Disabled Account [WILDPACKET]
    ... add the users SMTP address to the Email Addresses Tab. ... > disabled accounts to this Distribution Group??? ... >> Admin mailbox with disabled accounts by creating an empty DL list called ... >> MCSE, MCT, CCNA, Exchange MVP ...
    (microsoft.public.exchange.admin)
  • Re: Disabled Account [WILDPACKET]
    ... > Well, I'm not saying that disabled accounts can't receive e-mail period, I'm ... I'll check with POSTINI. ...
    (microsoft.public.exchange.admin)