Skip to main content

How to delegate out permissions to rename user accounts

This question came from one of my Active Directory classes. To find the solution, I installed RSAT on a Windows 8 client.  I also created a user named JYoder who is not a member of any special group. I also had to do a little bit of detective work to figure out a small piece of this puzzle.

The first real big problem is that I noticed the Last Name field is missing from the Delegate Control Wizard. We are missing the SN attribute which is the last name.  Here is where the fun starts.  On the client that you are using to delegate rights, Open dssec.dat  You will find it in %Systemroot%\System32.  Make a copy of this first and then open it in Notepad.

Now, scroll close to the bottom.  You will notice that the file is divided into object types.  Close to the bottom, you will find the User object.  Look for the SN field in the user object.  Make sure, you are in the user object.

image

Now, look for SN=7.  Change this to SN=0.  Save the changes

Now, close and re-open Active Directory Users and Computer.

Right click the OU that you want to delegate permissions to and select Delegate Control…

Click Next 

Click Add

Select the user whom you want to delegate permissions to and click  Check Names, and then OK

Click Next.

Click Create a custom task to delegate and click Next.

Select Only the following objects in the folder and then place a check by User objects.

Click Next

Uncheck General and check Property-specific

In the permissions list, place a check by:

  • Write: AccountNameHistory
  • Write: Display Name
  • Write: First Name
  • Write: Initials
  • Write: Last Name
  • Write: Logon Name
  • Write: Logon Name (Pre Windows 2000)
  • Write: Middle Name
  • Write: msDS-LastKnownRDN
  • Write: name
  • Write: Name

Click Next

Click Finish

 

Log on to the client as the user you have delegated rights to.

Open Active Directory Users and Computers.

Inside the OU where you delegated this user the rights to rename an account, right click a user account and select Rename.

Type the display name for the new user and press Enter.  This will open a Rename User box.

image

Change the necessary fields and click OK

To show that I cannot use the RSAT tools to perform actions that I am not allowed to do, I simple right click the Sales OU.  I can see that under all tasks, I am limited:

image

Also try some other functions to see that the Delegate Control Wizard did not give out more than you ask for.

Comments

Andy Fuhr said…
This trick is amazing. Can this same concept be used for other attributes like, Office, City, etc ?

Thanks
Andy,
Go in the DSSEC file. I do not have one in front of me, but I believe you will find what you are looking for.

I'm glad this helped you out.

Jason
Unknown said…
ms-DSlastknownrdn is also not visible

Popular posts from this blog

Adding a Comment to a GPO with PowerShell

As I'm writing this article, I'm also writing a customization for a PowerShell course I'm teaching next week in Phoenix.  This customization deals with Group Policy and PowerShell.  For those of you who attend my classes may already know this, but I sit their and try to ask the questions to myself that others may ask as I present the material.  I finished up my customization a few hours ago and then I realized that I did not add in how to put a comment on a GPO.  This is a feature that many Group Policy Administrators may not be aware of. This past summer I attended a presentation at TechEd on Group Policy.  One organization in the crowd had over 5,000 Group Policies.  In an environment like that, the comment section can be priceless.  I always like to write in the comment section why I created the policy so I know its purpose next week after I've completed 50 other tasks and can't remember what I did 5 minutes ago. In the Group Policy module for PowerShell V3, th

Return duplicate values from a collection with PowerShell

If you have a collection of objects and you want to remove any duplicate items, it is fairly simple. # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   # Remove the duplicate values. $Set1 | Select-Object -Unique 1 2 3 4 5 6 7 What if you want only the duplicate values and nothing else? # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   #Create a second collection with duplicate values removed. $Set2 = $Set1 | Select-Object -Unique   # Return only the duplicate values. ( Compare-Object -ReferenceObject $Set2 -DifferenceObject $Set1 ) . InputObject | Select-Object – Unique 1 2 This works with objects as well as numbers.  The first command creates a collection with 2 duplicates of both 1 and 2.   The second command creates another collection with the duplicates filtered out.  The Compare-Object cmdlet will first find items that are diffe

How to list all the AD LDS instances on a server

AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.