Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to delegate the rights to unlock user accounts in our Active Directory domain. This should be easy, and I've done it before... but every time the user tries to unlock an account (using the LockoutStatus tool), he gets denied with the error "You do not have the necessary permissions to unlock this account."

Here's what I've done:

  • I created a domain local group and added the members who should have the rights. This was created over a week ago, so the users have logged out and in again.
  • In ADUC, I've used the Delegate Rights wizard on the OU which contains our user accounts to grant permissions to Read lockoutTime and Writer lockoutTime to the group, per MSKB 279723
  • I have double-checked the permissions were applied correctly in ADSIEdit.
  • I have forced replication between all domain controllers to ensure the permission changes were copied over.
  • The user testing it has logged out and in again to ensure he has any changes applied to his account.

...That covers all the bases I can think of. Anything else I could be missing?

share|improve this question
If possible, can you try to give the user the ADUC MMC and see if they can unlock the account that way? It's possible the LockoutStatus tool is trying to use some other permission that your user doesn't have for whatever reason. – Paul Kroon Feb 14 '10 at 16:25
That's a good idea, Paul. I'll give it a try sometime... – ewall Mar 24 '10 at 18:19
up vote 3 down vote accepted

If you are facing problem with admin accounts then it might be related to permissions getting reset every hour basis due to AdminSDHolder


share|improve this answer

Have you verified the admins in question have not been explicitly denied access to that attribute through membership of another group?

share|improve this answer
Yes, verified... but good point. – ewall Dec 2 '11 at 17:04

I had a similar problem a few months ago, to resolve the issue I created a new group in AD, add the users in there, then I created a New Domain Group Policy and created a restricted group in the New Domain Policy then I added all of the users who need access to the AD Lockout tool from the new AD group I created to the Restricted group in the new group policy and bingo it worked.

Just make sure that you test this on a test domain first, to make sure you don’t break anything in live.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.