Re: Custom Delegation in AD

From: Joe Richards [MVP] (humorexpress_at_hotmail.com)
Date: 09/25/04

  • Next message: Karl Levinson [x y] mvp: "Re: Folder Security" 
    Date: Fri, 24 Sep 2004 21:37:16 -0400

    You can't natively. The delegation has to be to the entire attribute or not at all. 

    --
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net
kusdjeff wrote:
> I have a question about AD delegation.  I am in the process of creating an AD 
> custom delegation (modifying the delegwiz.inf).  I am able to set all the 
> rights for my environment except one.  How do I enable (delegate) my users 
> the ability to enable/disable accounts.  I understand that there is a 
> 'userAccountControl' option, but this grants too many rights.  I only want my 
> users the ability to enable/disable accounts without affecting other rights 
> such as "Password Never Expires" and "User Cannot Change Password".  How do I 
> go about doing this??
> 
> Thanks in advance, Jeff
  • Next message: Karl Levinson [x y] mvp: "Re: Folder Security"

    Relevant Pages

    • Re: Limiting Access Rights to AD from Windows 2000 Professional
      ... I've done the DELEGATION WIZARD. ... to review user information and change password. ... the user access her MMC console she can make changes to ... Can she have more rights flowing downwards that is ...
      (microsoft.public.win2000.active_directory)
    • Re: Custom Delegation in AD
      ... You can set up a proxy system where the admin contacts a web page or uses some ... The delegation has to be to the entire attribute or not at all. ... but this grants too many rights. ... >>>users the ability to enable/disable accounts without affecting other rights ...
      (microsoft.public.windows.server.security)
    • Re: Limiting Access Rights to AD from Windows 2000 Professional
      ... to do a customize delegation within the wizard. ... > to review user information and change password. ... > the user access her MMC console she can make changes to ... > overwriting the rights on a particular OU? ...
      (microsoft.public.win2000.active_directory)
    • Re: Mapping to W2003 user rights/access?
      ... > when it comes to access/user rights. ... I believe Clustering should need maximum Adminrights on the Cluster. ... > 6) Is there a granular delegation setting or something ... I wouldn't even use Account Operators, ...
      (microsoft.public.windows.server.migration)
    • Re: Delegate control questions
      ... You can rerun the delegation wizard again or do it manually in security tab. ... You can deny read access, that's one of the reasons for OU creation, but rather then denying to a user you should do this to a security group, same applies to delegation of control. ... Have delegated control to the local admin, so he can create users and groups, reset passwords, add computers to domain. ... Where and how can I see what rights I have delegated to him? ...
      (microsoft.public.windows.server.active_directory)