0 votes

We have a customized the help desk security role to allow only resetting passwords and unlocking accounts. We don't want them to be able to enable accounts that are disabled. I don't see an option for denying write of the property "Account is disabled" or "Useraccountcontrol" or "ms-ds-user-account-disabled". Is it possible to prevent the user from writing to certain "account options"? It seems that its an all or nothing setting.

by (2.3k points)

1 Answer

+1 vote
by (277k points)
selected by
Best answer

Hello Mark,

Unfortunately, it is not possible to disallow users to modify only specific Account Options flags as it is a single property.

As a solution, you can use a Business Rule triggering Before enabling a user account that will cancel the operation if it is performed by a Help Desk user. The rule will look like the following: image.png


Thanks! That will work!

Related questions

0 votes
1 answer

We have some accounts that we would like to prevent from changing their password on login when it is expired. This is because we have saml setup on individual interface pages ... of a loophole for us as we require dual factor and use saml to accomplish this.

asked Oct 26, 2021 by mark.it.admin (2.3k points)
0 votes
1 answer

Any advice would be greatly appreciated.

asked Feb 9, 2023 by Homelander90 (350 points)
0 votes
1 answer

I have setup a form to allow HR to edit some details on AD accounts. Currently the scope is limted to only AD object under one pre-chosen OU. The other option is an ldap filter. How can I allow this action to display user accounts from two seperate OU

asked Nov 18, 2019 by ice-dog (170 points)
0 votes
1 answer

Can you please advise on the best way to do this? We have a forest with four domains. In one of those domains we keep consultants, partners, and vendors (lets call ... Adaxes users from adding users from Domain X to any groups outside of Domain X. Thanks

asked Jan 29, 2013 by jiambor (1.2k points)
0 votes
0 answers

Hi, how can I change Help Desk to something a little more specific like "Onboarding Portal"? Or a bit more catchy that our HR will like rather then see Help Desk in the left hand corner.

asked Oct 9, 2019 by 6FigureMission (140 points)
3,411 questions
3,108 answers
545,843 users