Delegatiion Unlock Account
Windows Server Forum Index Windows Server
Server discussion on Windows platform.
 
 FAQFAQ   MemberlistMemberlist     RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 
 
Google
 
Web winserverhelp.com
Delegatiion Unlock Account

 
Post new topic   Reply to topic    Windows Server Forum Index -> Active Directory
Author Message
Joshua Bright
Guest
Posted: Fri Nov 11, 2005 5:50 pm    Post subject: Delegatiion Unlock Account Reply with quote
I have a user setup to read all, reset passwords, and create computer objects
in AD. I would like to allow the user to unlock user accounts. Is there a
way I can do this without giving the user access to creating users or
altering group membership? Thanks for your time.
Back to top
Joe Richards [MVP]
Guest
Posted: Fri Nov 11, 2005 9:50 pm    Post subject: Re: Delegatiion Unlock Account Reply with quote
Password unlock is simply delegation of the lockoutTime attribute. Specifically
you need to give someone the ability to write to the attribute - I.E. WP (Write
Property). There are KB articles on MS Support on how to do this.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Joshua Bright wrote:
Quote:
I have a user setup to read all, reset passwords, and create computer objects
in AD. I would like to allow the user to unlock user accounts. Is there a
way I can do this without giving the user access to creating users or
altering group membership? Thanks for your time.

Back to top
 
Post new topic   Reply to topic    Windows Server Forum Index -> Active Directory All times are GMT
Page 1 of 1

 
 You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum




New Topics Powered by phpBB