Delegating Permssion to the AdminSDHolder Object

Question

Hi There,

I've been asked to grant our identity management system the rights to set the AccountExpires attribute on Domain admin accounts (i'm still not sure this is a good idea in itself but i need to at least try).

I have delegated a group, to which my service account is a member, the permission to write to that property on the AdminSDHolder object using "DSACLS 'cn=adminSDholder,cn=system,dc=domain,dc=com' /I:S /G $sGrp":WP;accountExpires;user" and waited for the SDprop process to kick in, and I can see the delegation has been picked up on individual domain admin accounts.

However, when I attempt to update the accountExpires value using either "set-aduser -Identity samAccountName -AccountExpirationDate $date" or "Set-ADAccountExpiration -Identity samAccountName -DateTime "30/04/24"" I'm still getting an "Insufficient access rights" error.

Is what I'm doing the correct way to achieve my goal?

Answer 1

Hello broonster27,

Thank you for posting in Microsoft Community forum.

You can try to give service account to write to the property on the AdminSDHolder object via GUI manually and check if it helps.

If it helps, maybe you did not give the permission successfully using "DSACLS 'cn=adminSDholder,cn=system,dc=domain,dc=com' /I:S /G $sGrp":WP;accountExpires;user".

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 2

But you can see in the screen shot the permissions have been granted to the object correctly.

Answer 3

Hello broonster27,

Good day!

From the description you mentioned below, it seems the service account have no specific permissions.
when I attempt to update the accountExpires value using either "set-aduser -Identity samAccountName -AccountExpirationDate $date" or "Set-ADAccountExpiration -Identity samAccountName -DateTime "30/04/24"" I'm still getting an "Insufficient access rights" error.

You can check if this group with service account (or this service account) has all the permissions you want via GUI.

Right click one AdminSDHolder object and select Properties and Security tab,Advanced Security Settings\Effective Access\select a user (type this service account or this group)

Click "View Effective Access" button.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 4

I used the GUI to grant the same permissions and I'm still getting the access denied error. Also after the using the GUI the exact same permissions are assigned as when I was using DSACLS.

I tried using the effective access tab but the "Account Expires" attribute is not exposed to the GUI.

Answer 5

Hello broonster27,

Good day!

I tried using the effective access tab but the "Account Expires" attribute is not exposed to the GUI.
A: I can see the "AccountExpires" attribute on user Attribute Editor. Do you check it via right click one of Domain admin accounts.

Best Regards,
Daisy Zhou