Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to have Employee A be placed in Employee B's group temporarily while Employee B is, say, out sick? Is there a way to set an expiration of some sort so that Employee A could work on behalf of Employee B (with higher privelages) and then automatically be removed from the group when the expiration date arrives?

share
add comment

2 Answers

There is no built-in facility to do this. You could write a script to do it, or use scheduled task to kick off a script to do it. Or just write it down on a sticky note and have a peon do it manually.

share
    
I would also note that removing them from the group as the specified time might not invalidate their security tokens, so you'd also want to force them to logout. –  SpacemanSpiff Oct 18 '12 at 20:06
    
Haha, I like your sticky note option. –  user1620141 Oct 18 '12 at 20:10
add comment

Technically it is not possible. AD administrators can move user from one group to another but there is no such inbuilt functionality in AD to place moved users automatically to their original group. You have to do it manually every time. I am not sure about the 3rd party active directory management tools if they provide such kind of functionality. I would suggest please check some 3rd party tools if they be able to do this task. Below I am giving URLs of some 3rd party tools for your reference.

http://www.netwrix.com/group_policy_auditing_change_reporting_freeware.html

http://www.lepide.com/active-directory-self-service.html

http://www.jijitechnologies.com/

You can try these and look if any of these can help you out.

share
    
Thank you, I will check out the links. –  user1620141 Oct 19 '12 at 17:47
add comment

This site is currently not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .