I'm trying to delegate the rights to unlock user accounts in our Active Directory domain. This should be easy, and I've done it before... but every time the user tries to unlock an account (using the LockoutStatus tool), he gets denied with the error "You do not have the necessary permissions to unlock this account."

Here's what I've done:

  • I created a domain local group and added the members who should have the rights. This was created over a week ago, so the users have logged out and in again.
  • In ADUC, I've used the Delegate Rights wizard on the OU which contains our user accounts to grant permissions to Read lockoutTime and Writer lockoutTime to the group, per MSKB 279723
  • I have double-checked the permissions were applied correctly in ADSIEdit.
  • I have forced replication between all domain controllers to ensure the permission changes were copied over.
  • The user testing it has logged out and in again to ensure he has any changes applied to his account.

...That covers all the bases I can think of. Anything else I could be missing?

  • 1
    If possible, can you try to give the user the ADUC MMC and see if they can unlock the account that way? It's possible the LockoutStatus tool is trying to use some other permission that your user doesn't have for whatever reason.
    – Paul Kroon
    Feb 14 '10 at 16:25
  • That's a good idea, Paul. I'll give it a try sometime...
    – ewall
    Mar 24 '10 at 18:19

If you are facing problem with admin accounts then it might be related to permissions getting reset every hour basis due to AdminSDHolder



Have you verified the admins in question have not been explicitly denied access to that attribute through membership of another group?

  • Yes, verified... but good point.
    – ewall
    Dec 2 '11 at 17:04

I had a similar problem a few months ago, to resolve the issue I created a new group in AD, add the users in there, then I created a New Domain Group Policy and created a restricted group in the New Domain Policy then I added all of the users who need access to the AD Lockout tool from the new AD group I created to the Restricted group in the new group policy and bingo it worked.

Just make sure that you test this on a test domain first, to make sure you don’t break anything in live.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.