I work at a college for the next academic year all students under 18 must take a quick e-safety test before being given their windows logon (don't ask) so the accounts are created in a disabled state (userAccountControl property in AD). I have written the program to query the test results and it can enable users if I use a domain account.

But we want to give it out to a couple of users for manual overrides for various reasons so is it possible to create a service account that would only be able to modify the userAccountControl property?

Note: I'm a programmer not a network admin so please be gentle my AD knowledge is mostly for querying it


It's quite possible to do this. On your Student OU (assuming you have one) set a permission to modify it. To set it up right, in ADU&C, go to the OU object, right click and go to Properties

  • On the Security tab, click Advanced
  • Add the user
  • Select the Properties tab
  • Change it to "All Descendant User Objects"
  • Check "Read" and "Write" to "UserAccountControl"

That object will now be able to set the account state for all user objects in that OU.

How we've handled this problem is by creating a web application with its own authentication (we use our SSO solution to manage access to it) that handles these requests from your exception-desiring technicians. The web-app then performs the actions with the account created above. The app acts as an auditable proxy for who is unlocking what.

| improve this answer | |
  • Thanks yeah there was a Students OU and your guide gave my network admin the information to do it which he didn't know how to before. He said it was slightly different in Windows Server 2008 I wasn't watching him do it though so don't know how, just a note for anyone else looking at this question. – PeteT Aug 24 '10 at 10:58
  • I can't see the "All Descendant User Objects", just "Descendant User Objects". – PeterX May 27 '14 at 3:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.