Granting "Allow Delete subtree" ACL to a user object

Question

Hello,

you wrote "To remedy the issue, try granting the account appropriate permissions to delete users as subtree in Active Directory."

How can I add the permission within Adaxes to the user object?

Administrators -> add "delete subtree" or Adaxes Service Account -> add "delete subtree"

I don't want to grant the Adaxes service account permissions on all accounts affected by AdminSDHolder by updating the ACL on the AdminSDHolder object in AD. Only the to be deleted user object should be affected.

regards Helmut

Answer 1

Hello Helmut,

To perform operations in a managed domain, Adaxes uses the credentials specified for the domain. For information on how to check/change the account, have a look at the following help article: https://www.adaxes.com/help/?HowDoI.ManageActiveDirectory.ManageDomains.ChangeManagedDomainLogonInfo.html. It is not necessarily the Adaxes service account whose credentials were specified during Adaxes installation. The domain account should have all the necessary native Active Directory permissions to perform the operations you want to work in Adaxes for objects in the domain. As such, it is recommended to add the permission to delete subtree to the account over all the objects managed by Adaxes that should be available for deletion. Unfortunately, there is no possibility to manage native AD permissions for a domain in Adaxes, however, you can do it for objects in domains via the Edit Native Security option.