Re: Denying Account deletion

I dont have access to run this command from this site, I was using the mmc
remotely, but cant run the command through dos across the site. When I have
a chance I will, however in the meantime are there any gotcha's?

I just setup up a new domain, windows 2003 r2 all updates and have the same
problem using a windows xp sp2 with all updates, cant seem to run the
command on this domain using the example given to simply display the acl's
for the user account in question?


"Thor Vanden Reysen" <toto@xxxxxxx> wrote in message
news:OchZVgltGHA.3568@xxxxxxxxxxxxxxxxxxxxxxx
Hi,
Could you post DSACLS of a user object ??
Regards.


"Corey_in_Canada" <corey@xxxxxxxx> a écrit dans le message de news:
eGXyJNltGHA.4116@xxxxxxxxxxxxxxxxxxxxxxx
Hello all,

I am trying to configure a custom group to assign help desk staff to,
that will allow them to manipulate all user account rights including
disabling the account - without the rights to delete the account. Same
for groups.

I have created this group called accountadmins, added it the Domain
Policy security tab, clicked on advanced and chose my options, but it
seems that somewhere something is preventing this from working correctly.

If I enable the creation of user accounts for this test account that is a
member of this accountadmins group and try creating an account it always
comes back with an error saying the password can not set due to
unnecessary rights, or something like that, other times i get three of
four error dialogues depending on the rights chosen, however if i enable
the disable right, it will infact prevent from deleting but it will never
allow me to create.

Can someone let me know what rights or permissions are required to allow
this scenario to work Im guessing there are a few?

Any assistance would be greatly appreciated.

Thank you.





.

Relevant Pages

  • Re: Cannot Get Any Peer to Peer Non-Domain Networking to Work
    ... I create a common local user account foo on both computers A and B, ... The first command prompts for a user account and I supply foo, ... If the guest account is enabled ...
    (microsoft.public.windowsxp.network_web)
  • Re: Time Machine causing system to lock?
    ... Is your user account an administrator account or not? ... The Console File> Open System Log menu command will not display the ...
    (comp.sys.mac.misc)
  • Re: Prevent changes to Administrator password
    ... What I am trying to do is give Taz1972 some options to minimize the risk or make it harder for a lower-level DA to reset the password for the EA account. ... * This posting is provided "AS IS" with no warranties and confers no rights! ... > By adding the Deny Write Permissions ACE, ... > permission to modify the ACL on AdminSDHolder. ...
    (microsoft.public.windows.server.active_directory)
  • Re: delegating control over ou
    ... i didn't know which rights are responsible for ... locking an account was my mistake - of course it is ... not usefull to lock user account! ... >This is provided in the delegation wizard. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Robocopy Security and Authorization
    ... batch job' rights. ... user account has permissions to the resources and also use UNC paths as ... | appropriate robocopy commands. ...
    (microsoft.public.windows.server.general)
Quantcast