Disable Account

[Christer Hellquist]

Hi,

Is it possible to give a group or user the right just to
Disable Accounts in a Active Directory environemnt using
Windows 2003 Server?

I cannot find such right using Delegate Control.

Thanks in advance.

Regards,

Christer Hellquist

 

[ptwilliams]

Yes, but I don't know the exact right as I've never thought about doing
this.

Pull up the properties on an OU or container and choose security, and then
advanced. Now choose Add and in the box that pops up click on the
properties tab and have a look at the individual properties permissions to
see if what you want is there.

If it is, all well and good. If it isn't, fear not - all hope is not yet
lost! By default there are lots of properties hidden from that list, but
these can be unhidden by editing the DSSec.dat file on the computer that you
have loaded ADU&C on. If you need to edit this file, google for it for some
info. or post back here for one of us lot...

;-)

--

Paul Williams

http://www.msresource.net
http://forums.msresource.net
______________________________________
Hi,

Is it possible to give a group or user the right just to
Disable Accounts in a Active Directory environemnt using
Windows 2003 Server?

I cannot find such right using Delegate Control.

Thanks in advance.

Regards,

Christer Hellquist

 

[Joe Richards [MVP]]

Yes and No.

Yes you can give someone the ability to disable a user, but you can't JUST give
them that. The info for whether or not a user is disabled is maintained in a
flag of the attribute called userAccountControl. Theis attribute controlles
several things including password not expiring, etc.

If you want to go forward with this, you simply grant RW to userAccountControl.


joe