Delegated Permissions no longer applied after sometime, please help?

Question

I've been trying to find a solution for sometime now but haven't been able to, I delegated some permissions to user and it does work for time. User is able to login to the server and able to perform the tasks, but after sometime (days), the user will lose its ability to perform the delegated tasks. The options becomes grayed out. I have to remove the user account from the group or user names list under the security tab of the OU and go over the Delegate control wizard to reapply permissions. Any suggestions would high be appreciated.

Answer 1

Hi Mart,

Running the delegation wizard multiple times will not affect the existing permissions that have been assigned, as it only adds more permissions each time it is run.

The delegation of the Create, Delete, and Manage user accounts, and Reset user passwords and force password change at the next logon will assign the following permissions, permissions have been assigned to the 'Perms' users.

As these permissions will give you full permissions to the user objects, you don't technically need to delegate additional rights to unlock the accounts.

When you fix the problem, are you removing the users from the groups or just removing the permissions and reapplying them? When you do this, does the user need to restart ADUC to enable the grey options?

If you want to check that the permissions are still being applied to the user you can either the check the value of the sDRightsEffective attribute and confirm that it's 15 or use https://nettools.net/effective-permissions/ to look at the effective permissions.

Gary.