asked on PS script to unlock user accounts. And: is Delegation destructive?
I'm trying to delegate permission to a user to unlock locked accounts.
In Active Directory Users & Computers: for the OU containing all the users, I right-click Delegate Control | pick the person | pick create a custom task to delegate | pick 'user objects | then Pick property-specific | then check "read lockout time" and "write lockout time".
QUESTIONS:
1. Did this destroy previous permissions and replace it with just read & write lockout time?
2. When I run my powershell command, I get a red error: "Unlock-ADAccout: insufficient access rights to perform the operation"
I was following instructions at:
https://www.lepide.com/how-to/delegate-rights-to-unlock-account.html
Thanks for any thoughts,
Mike
In Active Directory Users & Computers: for the OU containing all the users, I right-click Delegate Control | pick the person | pick create a custom task to delegate | pick 'user objects | then Pick property-specific | then check "read lockout time" and "write lockout time".
QUESTIONS:
1. Did this destroy previous permissions and replace it with just read & write lockout time?
2. When I run my powershell command, I get a red error: "Unlock-ADAccout: insufficient access rights to perform the operation"
I was following instructions at:
https://www.lepide.com/how-to/delegate-rights-to-unlock-account.html
Thanks for any thoughts,
Mike
PowershellActive Directory
Last Comment
mike2401
That's strictly additive.
To remove permissions, enable the "Advanced Features" in the "View" menu of the ADUC console, open the properties of the OU, and you'll find the Security tab.
And do not, never, ever "pick the person". Don't delegate to individual accounts. Create a domain local group "AD_UnlockAccount" or whatever, delegate the permission to that group. Create a global role group "Helpdesk" or whatever, add that role group to the AD_UnlockAccount group. Finally, add "the person" to the global group.
What OS are you running on your DCs?
The following article mentions this problem, and even though it only refers to W2kR2/Win7, I can reproduce the exact behavior with Windows Server 2012: delegating LockoutTime works for the ADUC MMC, but not for Unlock-ADAccount.
Unlocking a user account fails when using ADAC or the Unlock-ADAccount cmdlet in Windows 7 or Windows Server 2008 R2 even if sufficient permissions are granted
https://support.microsoft.com/en-us/help/2577917/unlocking-a-user-account-fails-when-using-adac-or-the-unlock-adaccount
Delegating UserAccountControl didn't help, either.
What worked is the workaround described in the article: in the wizard, don't pick "Property specific", but leave the "General" selected, and check "Read and write account restrictions".
To remove permissions, enable the "Advanced Features" in the "View" menu of the ADUC console, open the properties of the OU, and you'll find the Security tab.
And do not, never, ever "pick the person". Don't delegate to individual accounts. Create a domain local group "AD_UnlockAccount" or whatever, delegate the permission to that group. Create a global role group "Helpdesk" or whatever, add that role group to the AD_UnlockAccount group. Finally, add "the person" to the global group.
What OS are you running on your DCs?
The following article mentions this problem, and even though it only refers to W2kR2/Win7, I can reproduce the exact behavior with Windows Server 2012: delegating LockoutTime works for the ADUC MMC, but not for Unlock-ADAccount.
Unlocking a user account fails when using ADAC or the Unlock-ADAccount cmdlet in Windows 7 or Windows Server 2008 R2 even if sufficient permissions are granted
https://support.microsoft.com/en-us/help/2577917/unlocking-a-user-account-fails-when-using-adac-or-the-unlock-adaccount
Delegating UserAccountControl didn't help, either.
What worked is the workaround described in the article: in the wizard, don't pick "Property specific", but leave the "General" selected, and check "Read and write account restrictions".
ASKER
Thanks @oBdA. I added read and write account restrictions to my userid on my win10 pc, and confirmed the OU's properties indeed refelct that in advanced security.
Nonetheless, I still get:
![testit.jpg]()
Nonetheless, I still get:
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
Genius @oBdA !!! Simply Genius!!
It's amazing you were able to solve the problem given how little info I included.
On the test ou, I only had the general settings, not the "property-specific" read/write lockout time.
As soon as I added that, BAM! It worked!
Thanks so much!
Truly impressive!
Mike
It's amazing you were able to solve the problem given how little info I included.
On the test ou, I only had the general settings, not the "property-specific" read/write lockout time.
As soon as I added that, BAM! It worked!
Thanks so much!
Truly impressive!
Mike
ASKER
Thanks again!!
ASKER
How do you give someone an endorsement?
Open in new window
Delegation Group
Delegation groups are named according to the permission that they grant. The permission that it grants can be, but is not limited to, AD permission to do a specific task.
Characteristics
Can only contain Role Groups
Cannot be members of any groups
Some examples of a built-in Delegation Group
Domain Administrators
Account Operators
Some examples of a custom Delegation Group
Password Reset
Manage Group Memberships
Role Group
Role groups should be created based on a specific role that group of people fulfil.
These groups are used to add delegation permissions to via delegation groups. This is done by adding the Role group as a member of the delegation groups for the permissions required.
It is worth noting that this delegation is not limited to AD permissions.
If the Help Desk supports SharePoint environment, a delegation group with certain SharePoint rights can be created and assigned to the Help Desk role group. This way when a new Help Desk employee starts, it is only required to add a user account to the Help Desk Role group.
Characteristics
Can only contain privileged user accounts
Can only be a member of Delegation Groups
Some examples of a Role Group
Help Desk
Server Administrators
Benefits
No delegation against individual user accounts
Reuse of Delegation Groups
Easy to manage
Quick to determine permissions
Uncomplicated to assign correct permissions to an individual based on their function
https://www.experts-exchange.com/articles/29366/Delegation-the-proper-way.html