I have been assigned the task of building out a sailpoint service account without assigning it Domain Admin permissions.

I have delegated control of the parent OU to the service account, as well as assigned the following permissions to the account

  • Read all properties
  • Read members
  • Write all properties
  • Write members

yet, when we try to reset a password in a sub-OU we get permission denied.

Am I missing something?


If performing an administrative reset, you need to grant the Reset Password Active Directory Extended Right. (00299570-246d-11d0-a768-00aa006e0529)

Example here: https://www.pwsh.ch/active-directory-powershell-delegate-permission-to-reset-user-passwords-for-a-specific-organizational-unit-150.html

function Set-ResetPasswordDelegation(){
    # Configuration Parameters
    $confADRight = "ExtendedRight"
    $confDelegatedObjectType = "bf967aba-0de6-11d0-a285-00aa003049e2" # User Object Type GUID
    $confExtendedRight = "00299570-246d-11d0-a768-00aa006e0529" # Extended Right PasswordReset GUID
    # Collect and prepare Objects
    $delegationGroup = Get-ADGroup -Identity $DelegationGroupName
    $delegationGroupSID = [System.Security.Principal.SecurityIdentifier] $delegationGroup.SID
    $delegationGroupACL = Get-Acl -Path "AD:\$OrganizationalUnit"
    # Build Access Control Entry (ACE)
    $aceIdentity = [System.Security.Principal.IdentityReference] $delegationGroupSID
    $aceADRight = [System.DirectoryServices.ActiveDirectoryRights] $confADRight
    $aceType = [System.Security.AccessControl.AccessControlType] "Allow"
    $aceInheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] "Descendents"
    $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($aceIdentity, $aceADRight, $aceType, $confExtendedRight, $aceInheritanceType,$confDelegatedObjectType)
    # Apply ACL
    Set-Acl -Path "AD:\$OrganizationalUnit" -AclObject $delegationGroupACL
# Calling the function
Set-ResetPasswordDelegation -OrganizationalUnit "OU=Users,DC=pwsh,DC=ch" -DelegationGroupName "ServiceDesk-PasswordReset-Allow"

The answer by Greg Askew is correct regarding the Reset Password permission that needs to be delegated, and they should get the answer credit, but I'm supplying some easier options, if it's not a bulk operation.

First, I suggest creating an AD group to delegate the permission to - eg. "StaffPasswordReset" or whatever. You may want to grant other users or groups the same right, and it stops your ACLs getting messy when you add others.

There's three main options (other than scripting) to grant the permissions, starting with the easiest, by far.

  1. Right-click on the OU and run the Delegate Control wizard on the OU. Literally the second pre-configured option is Reset User Passwords and Force Password Change at next logon. Select the account or group to delegate the permission to, and then you're done.

  2. In ADSIEdit, or in AD Users and Computers with Advanced View enabled, you can grant Reset Password to the user or group on the Security tab for the OU.

  3. Or you can use DSACLS, which is still significantly easier than the Powershell method.

    dsacls "OU=OUName,dc=example,dc=com" /I:S /G "[mydomain\delegate]:CA;Reset Password";user

Note: For options 2 and 3, since you've assigned Write All Properties already, presumably to Users, that should be sufficient. For option 1, the wizard sets all the required perms for resets.

However, if you only want to delegate password resets and don't want to grant "Write All Properties", you also need to add permissions to write to the user PwdlastSet and lockoutTime properties (as well as grant Reset Password). Again, either in the Security tab for the OU or with DSACLS

dsacls "OU=OUName,dc=example,dc=com"  /I:S /G "[mydomain\delegate]:rpwp;PwdlastSet";user
dsacls "OU=OUName,dc=example,dc=com" /I:S /G "[mydomain\delegate]:rpwp;lockoutTime";user

Note 2: Write Member is about granting permissions to add/remove Group members. Is this what's required? Do you have groups in the same OUs (or under the same parent OU) as users? If not, I'd suggest delegating that separately.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.