RE: [ActiveDir] Ad delegation
Interesting I saw your solved post before I saw the question post. 1. Delegate "reset password" extended right 2. Delegate WP on pwdLastSet (so they can write a 0 to the attribute) 3. Delegate WP on lockoutTime (so they can write a 0 to the attribute) - note this is called unlocking, not enabling. Assuming a group name of UserAdmins you can do this all with one command line dsacls cn=users,dc=domain,dc=com /I:S /G "useradmins:CA;Reset Password;user" "useradmins:WP;pwdLastSet;user" "useradmins:WP;lockoutTime;user" joe -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bruyere, Michel Sent: Tuesday, March 22, 2005 2:45 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Ad delegation Solved... > I would like to delegate 3 actions to the technicians in the AD. The 2 > first are easy to set, the third is the one that cause me a problem. > > 1- reset the users password > 2- set the "must change password at next logon" > 3- enable account that was disabled due to the password policy (locked > after bad attempts) > > I looked in the security and the delegation tabs and I never saw > anything concrete about it. > > Anyone has an idea on how to achieve it? > > BTW it's a Win2k native domain. List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
RE: [ActiveDir] Ad delegation
Here it is: Set these to the UO for the group/user you want * allow Reset Password permission for user objects-grants permission to reset an account's password * allow Write lockoutTime permission for user objects-grants permission to unlock an account * allow Write pwdLastSet permission for user objects-grants permission to set User must change password at next logon account property * allow Read AccountRestrictions permission for user objects-grants permission to read all account options > -Message d'origine- > De : [EMAIL PROTECTED] [mailto:ActiveDir- > [EMAIL PROTECTED] De la part de Francis Ouellet > Envoyé : Tuesday, March 22, 2005 2:54 PM > À : ActiveDir@mail.activedir.org > Objet : RE: [ActiveDir] Ad delegation > > Hi Michel, > > Care to explain the steps you took? > > Thanks! > Francis > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Bruyere, Michel > Sent: 22 mars 2005 14:45 > To: ActiveDir@mail.activedir.org > Subject: RE: [ActiveDir] Ad delegation > > Solved... > > > > I would like to delegate 3 actions to the technicians in the AD. The 2 > > > first are easy to set, the third is the one that cause me a problem. > > > > 1- reset the users password > > 2- set the "must change password at next logon" > > 3- enable account that was disabled due to the password policy (locked > > > after bad attempts) > > > > I looked in the security and the delegation tabs and I never saw > > anything concrete about it. > > > > Anyone has an idea on how to achieve it? > > > > BTW it's a Win2k native domain. > > List info : http://www.activedir.org/List.aspx > List FAQ: http://www.activedir.org/ListFAQ.aspx > List archive: > http://www.mail-archive.com/activedir%40mail.activedir.org/ > List info : http://www.activedir.org/List.aspx > List FAQ: http://www.activedir.org/ListFAQ.aspx > List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
RE: [ActiveDir] Ad delegation
The third is not enabling a user account, but I think you mean UNLOCKING the account. For that you need read and write permission on the lockoutTime property. In W2K3 this delegation IS available For more info on how to configure this see: * How to grant help-desk personnel the specific right to unlock locked user accounts (http://support.microsoft.com/?id=279723) * How To Delegate the Unlock Account Right (http://support.microsoft.com/?id=294952) Cheers Jorge -Original Message- From: [EMAIL PROTECTED] To: ActiveDir@mail.activedir.org Sent: 3/22/2005 8:27 PM Subject: [ActiveDir] Ad delegation Hi, It's me again. I have another problem ;) I would like to delegate 3 actions to the technicians in the AD. The 2 first are easy to set, the third is the one that cause me a problem. 1- reset the users password 2- set the "must change password at next logon" 3- enable account that was disabled due to the password policy (locked after bad attempts) I looked in the security and the delegation tabs and I never saw anything concrete about it. Anyone has an idea on how to achieve it? BTW it's a Win2k native domain. Thanks! List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
RE: [ActiveDir] Ad delegation
Hi Michel, Care to explain the steps you took? Thanks! Francis -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bruyere, Michel Sent: 22 mars 2005 14:45 To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Ad delegation Solved... > I would like to delegate 3 actions to the technicians in the AD. The 2 > first are easy to set, the third is the one that cause me a problem. > > 1- reset the users password > 2- set the "must change password at next logon" > 3- enable account that was disabled due to the password policy (locked > after bad attempts) > > I looked in the security and the delegation tabs and I never saw > anything concrete about it. > > Anyone has an idea on how to achieve it? > > BTW it's a Win2k native domain. List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
RE: [ActiveDir] Ad delegation
Solved... > I would like to delegate 3 actions to the technicians in the AD. The 2 > first are easy to set, the third is the one that cause me a problem. > > 1- reset the users password > 2- set the "must change password at next logon" > 3- enable account that was disabled due to the password policy (locked > after bad attempts) > > I looked in the security and the delegation tabs and I never saw > anything concrete about it. > > Anyone has an idea on how to achieve it? > > BTW it's a Win2k native domain. List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
RE: [ActiveDir] AD delegation white paper
I talked to the PM involved last week, and he indicated "a couple of weeks". Grain-of-salt-rules apply. -gil Gil Kirkpatrick CTO, NetPro -Original Message- From: Sullivan, Kevin [mailto:[EMAIL PROTECTED] Sent: Friday, October 10, 2003 6:33 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] AD delegation white paper Not yet, I think it is a month out... Just my guess. Kevin -Original Message- From: Graham Turner [mailto:[EMAIL PROTECTED] Sent: Thursday, October 09, 2003 6:02 PM To: [EMAIL PROTECTED] Have come back to the list after a while away - the paper on AD delegation from MS looks to be of some good value - is this published yet ?? GT List info : http://www.activedir.org/mail_list.htm List FAQ: http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ: http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ: http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
RE: [ActiveDir] AD delegation white paper
Not yet, I think it is a month out... Just my guess. Kevin -Original Message- From: Graham Turner [mailto:[EMAIL PROTECTED] Sent: Thursday, October 09, 2003 6:02 PM To: [EMAIL PROTECTED] Have come back to the list after a while away - the paper on AD delegation from MS looks to be of some good value - is this published yet ?? GT List info : http://www.activedir.org/mail_list.htm List FAQ: http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ: http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
