I have a Domain running on Windows 2003, in 2000 mode. I'm trying to create an AD group to grant temporary Domain Admin permissions to user, to save having to give them permanent DA.
I've created an AD group: g.Temp_DomainAdmin, in an OU: Groups/Admin/Delegated Permissions.
I've got a scheduled task running a VBScript to remove all users from this group.
The task runs as a service account, with limited permissions: s.purge_temp_da
I've delegated permissions on the OU to the service account to allow full control over groups under it.
Running the task manually works perfectly. But whenever it comes to run at midnight, it fails with "-2147024891 - General access denied error". Looking at the g.Temp_DomainAdmin group shows that the delegated permissions have disappeared.
Any ideas? Here's the VBScript:
Option Explicit Dim objRootDSE, strDomain, objGroup, objUser, strdistinguishedName, arrDnComponents Const ADS_PROPERTY_DELETE = 4 ' Retrieve domain information Set objRootDSE = GetObject("LDAP://RootDSE") strDomain = objRootDSE.Get("DefaultNamingContext") ' Bind to the group Set objGroup = GetObject("LDAP://CN=G.ADM.Temp_DomainAdmin,OU=Delegated Permissions,OU=Admin,OU=Resource Access,OU=groups," & strDomain) ' Iterate through the user objects in the group For Each objUser In objGroup.Members on error resume next ' Get the users distinguishedName strdistinguishedName = objUser.distinguishedName wscript.echo "Removing " & objUser.cn ' Remove the user from the group objGroup.PutEx ADS_PROPERTY_DELETE, "member", Array(strdistinguishedName) objGroup.SetInfo wscript.echo "Removed " & objUser.cn if err.number <> 0 then wscript.echo err.number & " - " & err.description end if on error goto 0 Next wscript.echo "Done"