Re: Unlock acct permissions

From: Joe Richards [MVP] (humorexpress_at_hotmail.com)
Date: 02/18/05 

Date: Thu, 17 Feb 2005 19:58:09 -0500

By any chance is the account they are trying to work on another enhanced user
account, say an account op or something? If so, look into adminSDHolder posts.
If not, look at the ACL with DSACLS and verify the delegation occurred as
expected and if it is correct (should be WP on lockoutTime) then have the admin
log off and log on and try again.

   joe 

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net
Brian wrote:
> Thanks I applied both methods on article 279723 plus article 294952 and still 
> no access.  The correct permissions are on the security group, the user I 
> added to the security group still cannot do anything with account unlock or 
> password reset.  Where can I see the effective permissions of the user since 
> they are a memeber of this security group?  The securty group is a memeber of 
> the built-in Account operators as well.  Is there default deny on regular 
> users accounts that is blocking this?  Any help in what this could be would 
> be appreciated.  Thanks
> 
> "Laura E. Hunter (MVP)" wrote:
> 
> 
>>How to grant help desk personnel the specific right to unlock user accounts: 
>>http://support.microsoft.com/?kbid=279723
>>
>>-- 
>>Laura E. Hunter
>>Microsoft MVP - Windows Server Networking
>>All information provided "AS-IS", no warranties expressed or implied.
>>Replies to newsgroup only.
>>"Brian" <Brian@discussions.microsoft.com> wrote in message 
>>news:51FD5CA8-A66D-43C7-A57C-B85BF1F15FCA@microsoft.com...
>>
>>>What permissions are necessary for a user to be able to unlock an account 
>>>or
>>>reset a password.  I have an MMC created for user to reset passwords (will
>>>this fix an account lockout?) in an OU.  I have the user added to a admin
>>>group I created for the OU.  I continued to get access denised when try to
>>>reset password.  What permissions are necessary and where to access them 
>>>as
>>>the enterprose admin.  Does password reset unlock an account or is that
>>>seperate permissions? Thanks 
>>
>>
>>

Relevant Pages

  • Re: Delegate Control... Reset Passwords
    ... Also, If I check the Security properties of an actual user account, I don't ... PCAdmins from the "Print Operators" group, ... that Read and Write permissions in pwdLastSet attribute. ... RESET USER PASSWORDS ...
    (microsoft.public.windows.server.active_directory)
  • Re: Unlock acct permissions
    ... >>>>-->>Joe Richards Microsoft MVP Windows Server Directory Services>>www.joeware.net>> ... I'm just trying to give a user>>>account unlock permission for an OU by making them a member of a security>>>group in that OU with permission to unloack accounts. ... Every one will have to full admins unless I can make>>>this Windows permissions work as desired. ... The correct permissions are on the security group, the user I>>>>>added to the security group still cannot do anything with account unlock or>>>>>password reset. ...
    (microsoft.public.win2000.active_directory)
  • Re: Unlock acct permissions
    ... Joe is one of the best in the world. ... How do I get DSACLS to run on a specific account? ... The permissions in the security do not seem>>> to ... The correct permissions are on the security group, ...
    (microsoft.public.win2000.active_directory)
  • Re: granting folder access to network users
    ... It is really easier to work with groups for configuring permissions ... account is used for example form the windows installer when new software ... Please post the complete share permissions and the folder NTFS permissions, ... In AD create a security group and add the user to this group. ...
    (microsoft.public.windows.server.setup)
  • Re: Unlock acct permissions
    ... Thanks I applied both methods on article 279723 plus article 294952 and still ... The correct permissions are on the security group, ... the built-in Account operators as well. ...
    (microsoft.public.win2000.active_directory)
Loading