Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I work at a college for the next academic year all students under 18 must take a quick e-safety test before being given their windows logon (don't ask) so the accounts are created in a disabled state (userAccountControl property in AD). I have written the program to query the test results and it can enable users if I use a domain account.

But we want to give it out to a couple of users for manual overrides for various reasons so is it possible to create a service account that would only be able to modify the userAccountControl property?

Note: I'm a programmer not a network admin so please be gentle my AD knowledge is mostly for querying it

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

It's quite possible to do this. On your Student OU (assuming you have one) set a permission to modify it. To set it up right, in ADU&C, go to the OU object, right click and go to Properties

  • On the Security tab, click Advanced
  • Add the user
  • Select the Properties tab
  • Change it to "All Descendant User Objects"
  • Check "Read" and "Write" to "UserAccountControl"

That object will now be able to set the account state for all user objects in that OU.

How we've handled this problem is by creating a web application with its own authentication (we use our SSO solution to manage access to it) that handles these requests from your exception-desiring technicians. The web-app then performs the actions with the account created above. The app acts as an auditable proxy for who is unlocking what.

share|improve this answer
    
Thanks yeah there was a Students OU and your guide gave my network admin the information to do it which he didn't know how to before. He said it was slightly different in Windows Server 2008 I wasn't watching him do it though so don't know how, just a note for anyone else looking at this question. –  PeteT Aug 24 '10 at 10:58
    
I can't see the "All Descendant User Objects", just "Descendant User Objects". –  PeterX May 27 at 3:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.