Solved

ADUC properties for user/group security tab with advanced features checked

Posted on 2010-11-08
9
583 Views
Last Modified: 2012-05-10
In AD when selecting properties for a user or group with advanced features checked under view, this enables a security tab.  We have users in this tab that can change passwords and reset passwords.  Where are these users defined to have these permissions?  We have a desktop admins group but the user has been removed.  I am not sure if that is where they get the permissions from, just thought I would mention that.  I would like to remove a few of the users but they are in every user/group.

Running 2008 R2 domain/forest.
0
Comment
Question by:asrvwiz
  • 4
  • 4
9 Comments
 
LVL 27

Expert Comment

by:KenMcF
ID: 34086685
If you go into the advanced settings on the security tab it will show you where it is getting the inherited permissions from.

 
0
 
LVL 2

Expert Comment

by:rstaats
ID: 34086707
You can right-click on an OU and select delegate control.  That walks you through a wizard that allows you to grant access to other users in the maner that you're speaking of.
0
 

Author Comment

by:asrvwiz
ID: 34087074
KenMcF - I see where the inheritence is coming from.  Can you just remove the user?

rstaats - I ran the delegate control wizard and I did not have the option to remove any users, so I am not sure how the users were granted these privlidges or if it is an issue with rasing the domain/forest level to 2008 R2 from 2003.  I can not remember if we used the delegate control wizard but if we did I would think the users should be removed in the same manner that they were added????
0
 
LVL 27

Expert Comment

by:KenMcF
ID: 34087104
If it is a user account yes you can just remove from where the perms are set. But this will remove these permissions from everywhere below where there perms are set. Is this what you are looking to do?
0
The curse of the end user strikes again      

You’ve updated all your end user’s email signatures. Hooray! But guess what? They’re playing around with the HTML, adding stupid taglines and ruining the imagery. Find out how you can save your signatures from end users today.

 

Author Comment

by:asrvwiz
ID: 34087166
KenMcF- Two of the uers worked at the help desk and have moved to other positions.  I want to remove them so they no longer can reset/change passwords.  What do yo mean "but this will remove these permissions from everywhere below where there perms are set."
0
 
LVL 27

Expert Comment

by:KenMcF
ID: 34087456
can you send a screen shot of what you have.

From what you described it sounds like you are giving individual users this access, I prefer to do this by security groups. If you would remove one of these users from the security tab then that user will not have the access to OUs. Groups, Users below where the permissions where removed depending on what permissions it had.
0
 

Author Comment

by:asrvwiz
ID: 34087597
KenMcF - File attached  We have a group in there, not sure why the users are as well.  Just trying to clean this up a bit.
security-tab.docx
0
 
LVL 27

Accepted Solution

by:
KenMcF earned 500 total points
ID: 34087625
In my opinion I would remove all users and assign all your needed permissions to security groups. Then add all your users to these groups. Then when you need to remove or add users to this access you would just add or remove from the groups and not have to remove individual users. You can set the permissions through the delegation wizard.
0
 

Author Closing Comment

by:asrvwiz
ID: 34087776
Ken,

Thanks for all your help!
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We recently had an issue where out of nowhere, end users started indicating that their logins to our terminal server were just showing a "blank screen." After checking the usual suspects -- profiles, shell=explorer.exe in the registry, userinit.exe,…
OfficeMate Freezes on login or does not load after login credentials are input.
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now