Permissions on AD Group

Question

Hi All i have an AD group and i want to give permission for a service account to remove the members from that AD group. Except removing the users from that AD group, service account should not be able to perform any other activity on that AD Group. Experts guide me with Removal permissions. AD Group properties-->security-->added the serviceaccount-->clicked Advanced settings-->double clicked the serviceaccount, Properties->i can see Write Members permission but i believe it will provide add/remove members , i am looking just to remove members permissions. please guide me.

Answer 1

Hello Glenn Maxwell,

Thank you for posting in Q&A forum.

For setting permissions on AD group, you can only use "add/remove members" permissions, it will let the users add or remove the members in this AD group.

However, you can try to using Delegation Control wizard on containers, then you can select "Create selected objects in this folder" or "Delete selected objects in this folder".

Here is a similar thread about setting permissions on AD containers (only with "Create selected objects in this folder" but with no "Delete selected objects in this folder"). https://serverfault.com/questions/336723/grant-permission-in-active-directory-to-add-users-modify-changed-password I hope the information above is helpful. If you have any question or concern, please feel free to let us know. Best Regards, Daisy Zhou

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

As far as I know, you cannot assign a distinct permission that would allow you to remove group members but not to add them

---

hth
Marcin

Answer 3

Hi @Glenn Maxwell

i can see Write Members permission but i believe it will provide add/remove members , i am looking just to remove members permissions.

You are right, unfortunately there is no option let you to give only delete permission of group membership. You have to deal with Write permission if you want allow the service account remove members of target groups:

---

Please don't forget to accept helpful answer