Cant find “Read Lockout Time” and “Write Lockout Time” for delegation on OU

active-directorydelegationorganizational-unitwindows-server-2003-r2windows-server-2008-r2

Trying to delegate permissions to a group on a OU; but cant find 2 properties in special permissions for "User Objects" they are "Read Lockout Time" and "Write Lockout Time" any reason i couldnt see them? I am using ADUC tool on a windows 7 machine with domain consisting of both windows 2003 R2 and Windows 2008 R2 domain controllers and i am a domain admin.

Best Answer

Did you actually %windir%\System32\dssec.dat to allow you to see these in ADUC on the computer you are using to create the delegations? If you haven't changed the values from 7 to 0 then it won't show up in the GUI.

See here for details: http://www.expta.com/2008/09/how-to-delegate-right-to-unlock-user.html

enter image description here

Related Solutions

Delegating account unlock rights in AD

If you are facing problem with admin accounts then it might be related to permissions getting reset every hour basis due to AdminSDHolder

Details

What do the “Read personal information” and “Write personal information” Active Directory permissions entail

According to this article, those permissions affect these attributes:

streetAddress

homePostalAddress

assistant

info

country/region name

facsimileTelephoneNumber (fax number)

International-ISDN-Number

Locality-Name

MSMQ-Digests

mSMQSignCertificates

Personal-Title

Phone-Fax-Other

Phone-Home-Other

Phone-Home-Primary

otherIpPhone

ipPhonenumber

primaryInternationalISDNNumber Phone-ISDN-Primary

Phone-Mobile-Other (otherMobile)

Phone-Mobile-Primary

Phone-Office-Other (otherTelephone)

Phone-Pager-Other

Phone-Pager-Primary

physicalDeliveryOfficeName

thumbnailPhoto (Picture)

postalCode

preferredDeliveryMethod

registeredAddress

State-Or-Province-Name

Street-Address

telephoneNumber

teletexTerminalIdentifier

telexNumber

primaryTelexNumber

userCert

User-Shared-Folder

User-Shared-Folder-Other

userSMIMECertificate

x121Address

X509-Cert

The user's name is not included in this list, so those aren't the proper permissions to grant. "General Information" is the category you'll find the name under.

Best Answer

Related Solutions

Delegating account unlock rights in AD

What do the “Read personal information” and “Write personal information” Active Directory permissions entail

Related Topic