Grant Rights to Modify Account Options
Each Active Directory user account has a number of account options that determine security and password settings for logon and authentication. All these options are set via the Account Options (userAccountControl) property of a user account.
View Descriptions of Account Options
| Account Option | Description |
|---|---|
| User must change password at next logon | Allows forcing the user to change his/her password the next time this user logs on to the network. |
| User cannot change password | Allows preventing the user from changing his/her password. This allows you to keep control over the account. |
| Password never expires | Allows preventing the expiration of the user password. |
| Store passwords using reversible encryption | Allows permitting this user to log on to a Windows network from Apple computers. |
| Account is disabled | Allows enabling/disabling user accounts. |
| Smart card is required for interactive logon | Allows permitting users to use a smart card to log on to the network interactively. |
| Account is trusted for delegation | Allows a service running under this account to perform operations on behalf of other user accounts on the network. |
| Account is sensitive and cannot be delegated | Allows forbidding the assignment of user accounts for delegation by another account. |
| Use DES encryption types for this account | Allows restricting users to use only Data Encryption Standard (DES) encryption types for keys. |
| Do not require Kerberos pre-authentication | Allows permitting the usage of alternate implementations of the Kerberos protocol. |
In order to allow specific users or groups to modify user account options in Active Directory, you need to grant them the Write 'Account Options' Property permission. For this purpose, you need to create a Security Role that grants this permission and assign the new Role to the users or groups, to which you want to allow modifying account options.
Launch Adaxes Administration
Console, right-click your Adaxes service, point to New and click
Security
Role
. The Create Security Role wizard will open.
Enter the name
for the new Role, and click Next.
Here you need to
specify permissions the new Role will grant. To allow modifying user account options,
you need to grant the Write 'Account Options' Property permission. Clicking
the Add button will display the Add Permissions dialog.
In the list of object types, to which permissions are applied, select User.
In the Property-specific permissions section, check the
Write 'Account Options'
Property
permission in the Allow column. Click OK.
Optionally, add the Read permission
Click the Add button to return to the Add Permissions dialog. Select the Read permission in the Allow column of the General permissions section. Click OK.
The Write
'Account Options' Property permission allows modifying all account options, except
the following:
- User must change password at next logon,
- User cannot change password,
- Password never expires.
To grant these permissions too, you need to add also the Write ‘Password Last Set' Property and Write ‘User Cannot Change Password' Property permissions.
See step-by-step
- At the Role Permissions page of the wizard, click Add to open the the Add Permissions dialog.
- In the list of object types, to which permissions are applied, select User.
- Check Show all properties below the Property-specific permissions section.
- Check the Write ‘Password Last Set' Property and Write ‘User Cannot Change Password' Property permissions in the Allow column. Click OK.
Click Next.
Here, at the Assign Role page, specify users or groups to which you want
to assign the new Role. To quickly find a user or group, type its name in the search
field. Click
Search and select the object you need in the search results. Click the Assign
button.
In the Role Activity Scope
dialog that opens, you need to specify, to which objects the users or groups selected at the
previous step, will be able to apply permissions granted by the new Role.
You can select one of the following items:
-
All Objects - select if you want to allow the users or groups specified at
the previous step to modify options of any user account in any AD domain managed
by the Adaxes service.
-
Specific Domain - select a specific AD domain if you want to allow modifying
options of any account in the AD domain you specify. If you select a domain, you
will need to specify the assignment scope in the Assignment Options dialog.
Assignment Options
Select All objects in this Domain. It means that users or groups specified at the previous step will be able to apply permissions of the new Role to all accounts in the selected domain. Click OK.
-
OU or Container - select a specific organizational unit or container if you
want to allow modifying account options of any user located in the selected OU or
container. If you select an OU or container, you will need to specify the assignment
scope in the Assignment Options dialog.
Assignment Options
To allow modifying account options of all children of the selected OU at any nesting level, click Child objects of this Organizational-Unit. To allow modifying account options of the direct child objects of the selected OU only, check also Immediate child objects only. Select the option you need and click OK.
-
Group - select a specific group if you want to allow modifying account options
of any user that is a member of the selected group. If you select a group, you will
need to specify the assignment scope in the Assignment Options dialog.
Assignment Options
To allow modifying account options of any group member, select Members of this Group. To allow modifying account options of direct group members only, check also Direct members only . Click OK.
-
Business Unit - select a Business Unit if you want to allow modifying options
of user accounts that are members of a specific Business Unit. To view available
Business Units, select the Business Units item in the Look in drop-down
list.
If you select a Business Unit, you will need to specify the assignment scope in the Assignment Options dialog.
Assignment Options
In this case, the only applicable option is Members of this Business Unit. It means that the new Role permissions will be applied to all user accounts that are the members of the selected Business Unit. Select this option and click OK.
Select the object you need and click Add. When finished, click OK.
When specified,
the assignments will be displayed in the Assignments list. To add assignments
to other users or groups, repeat steps 5 and 6. Click Finish.
