Click here to get back home

Specific permission to add new contacs
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Specific permission to add new contacs jonte@bson.se 04-09-2008
Posted by jonte@bson.se on April 9, 2008, 7:42 am
Please log in for more thread options
 I want a group of users to be able to add new contacts under a specific OU
but I can't find out how ? I don't want them to be able to create new users
and groups.
I'v tried to give them All permissions on object contact in that OU but they
are still not able to create new ones.

Can you help me out ?

Sincerely

\Jonas B



Posted by neo [mvp outlook] on April 9, 2008, 8:41 am
Please log in for more thread options
 Our site went the route of creating a custom delegwiz.inf file that allowed
us to use delegate wizard to dish out the appropriate rights the group
should have on said OU. Here is a copy of our custom inf file. You would
be interested in template 240.


[Version]
signature="$CHICAGO$"

[DelegationTemplates]

Templates = template130,template140,template180,template210,template240


;----------------------------------------------------------
[template130]
AppliesToClasses=organizationalUnit

Description = "Create, delete, and manage user accounts"

ObjectTypes = SCOPE, user

[template130.SCOPE]
user=CC,DC

[template130.user]
CONTROLRIGHT= "Reset Password"
@=WP

;----------------------------------------------------------

;----------------------------------------------------------
[template140]
AppliesToClasses=organizationalUnit

Description = "Create, delete, and managed groups"

ObjectTypes = SCOPE, group

[template140.SCOPE]
group=CC,DC

[template140.group]
@=WP

;----------------------------------------------------------

;----------------------------------------------------------
[template180]
AppliesToClasses=organizationalUnit

Description = "Create, delete, and manage computer accounts"

ObjectTypes = SCOPE, computer

[template180.SCOPE]
computer=CC,DC

[template180.computer]
CONTROLRIGHT= "Reset Password"
@=WP
;----------------------------------------------------------

;----------------------------------------------------------
[template210]
AppliesToClasses=organizationalUnit

Description = "Create, delete, and manage an OU"

ObjectTypes = SCOPE, organizationalUnit

[template210.SCOPE]
organizationalUnit=CC,DC

[template210.organizationalUnit]
@=WP
;----------------------------------------------------------

;----------------------------------------------------------
[template240]
AppliesToClasses=organizationalUnit

Description = "Create, delete, and manage contacts"

ObjectTypes = SCOPE, contact

[template240.SCOPE]
contact=CC,DC

[template240.contact]
@=WP
;----------------------------------------------------------


>I want a group of users to be able to add new contacts under a specific OU
>but I can't find out how ? I don't want them to be able to create new users
>and groups.
> I'v tried to give them All permissions on object contact in that OU but
> they are still not able to create new ones.
>
> Can you help me out ?
>
> Sincerely
>
> \Jonas B
>



Posted by jonte@bson.se on April 10, 2008, 2:45 am
Please log in for more thread options
Cool features. I took it all and it seem to work, great :) !

Sincerely

\Jonas B

> Our site went the route of creating a custom delegwiz.inf file that
> allowed us to use delegate wizard to dish out the appropriate rights the
> group should have on said OU. Here is a copy of our custom inf file. You
> would be interested in template 240.
>
>
> [Version]
> signature="$CHICAGO$"
>
> [DelegationTemplates]
>
> Templates = template130,template140,template180,template210,template240
>
>
> ;----------------------------------------------------------
> [template130]
> AppliesToClasses=organizationalUnit
>
> Description = "Create, delete, and manage user accounts"
>
> ObjectTypes = SCOPE, user
>
> [template130.SCOPE]
> user=CC,DC
>
> [template130.user]
> CONTROLRIGHT= "Reset Password"
> @=WP
>
> ;----------------------------------------------------------
>
> ;----------------------------------------------------------
> [template140]
> AppliesToClasses=organizationalUnit
>
> Description = "Create, delete, and managed groups"
>
> ObjectTypes = SCOPE, group
>
> [template140.SCOPE]
> group=CC,DC
>
> [template140.group]
> @=WP
>
> ;----------------------------------------------------------
>
> ;----------------------------------------------------------
> [template180]
> AppliesToClasses=organizationalUnit
>
> Description = "Create, delete, and manage computer accounts"
>
> ObjectTypes = SCOPE, computer
>
> [template180.SCOPE]
> computer=CC,DC
>
> [template180.computer]
> CONTROLRIGHT= "Reset Password"
> @=WP
> ;----------------------------------------------------------
>
> ;----------------------------------------------------------
> [template210]
> AppliesToClasses=organizationalUnit
>
> Description = "Create, delete, and manage an OU"
>
> ObjectTypes = SCOPE, organizationalUnit
>
> [template210.SCOPE]
> organizationalUnit=CC,DC
>
> [template210.organizationalUnit]
> @=WP
> ;----------------------------------------------------------
>
> ;----------------------------------------------------------
> [template240]
> AppliesToClasses=organizationalUnit
>
> Description = "Create, delete, and manage contacts"
>
> ObjectTypes = SCOPE, contact
>
> [template240.SCOPE]
> contact=CC,DC
>
> [template240.contact]
> @=WP
> ;----------------------------------------------------------
>
>
>>I want a group of users to be able to add new contacts under a specific OU
>>but I can't find out how ? I don't want them to be able to create new
>>users and groups.
>> I'v tried to give them All permissions on object contact in that OU but
>> they are still not able to create new ones.
>>
>> Can you help me out ?
>>
>> Sincerely
>>
>> \Jonas B
>>
>
>



Posted by jonte@bson.se on April 10, 2008, 3:54 am
Please log in for more thread options
Adding contact works fine but when they try to establish an Email address
they are not allowed, and in my case they are adding them to establish an
SMTP address, thats why they add an contact.
Could you help me there too ?

\Jonas B

> Our site went the route of creating a custom delegwiz.inf file that
> allowed us to use delegate wizard to dish out the appropriate rights the
> group should have on said OU. Here is a copy of our custom inf file. You
> would be interested in template 240.
>
>
> [Version]
> signature="$CHICAGO$"
>
> [DelegationTemplates]
>
> Templates = template130,template140,template180,template210,template240
>
>
> ;----------------------------------------------------------
> [template130]
> AppliesToClasses=organizationalUnit
>
> Description = "Create, delete, and manage user accounts"
>
> ObjectTypes = SCOPE, user
>
> [template130.SCOPE]
> user=CC,DC
>
> [template130.user]
> CONTROLRIGHT= "Reset Password"
> @=WP
>
> ;----------------------------------------------------------
>
> ;----------------------------------------------------------
> [template140]
> AppliesToClasses=organizationalUnit
>
> Description = "Create, delete, and managed groups"
>
> ObjectTypes = SCOPE, group
>
> [template140.SCOPE]
> group=CC,DC
>
> [template140.group]
> @=WP
>
> ;----------------------------------------------------------
>
> ;----------------------------------------------------------
> [template180]
> AppliesToClasses=organizationalUnit
>
> Description = "Create, delete, and manage computer accounts"
>
> ObjectTypes = SCOPE, computer
>
> [template180.SCOPE]
> computer=CC,DC
>
> [template180.computer]
> CONTROLRIGHT= "Reset Password"
> @=WP
> ;----------------------------------------------------------
>
> ;----------------------------------------------------------
> [template210]
> AppliesToClasses=organizationalUnit
>
> Description = "Create, delete, and manage an OU"
>
> ObjectTypes = SCOPE, organizationalUnit
>
> [template210.SCOPE]
> organizationalUnit=CC,DC
>
> [template210.organizationalUnit]
> @=WP
> ;----------------------------------------------------------
>
> ;----------------------------------------------------------
> [template240]
> AppliesToClasses=organizationalUnit
>
> Description = "Create, delete, and manage contacts"
>
> ObjectTypes = SCOPE, contact
>
> [template240.SCOPE]
> contact=CC,DC
>
> [template240.contact]
> @=WP
> ;----------------------------------------------------------
>
>
>>I want a group of users to be able to add new contacts under a specific OU
>>but I can't find out how ? I don't want them to be able to create new
>>users and groups.
>> I'v tried to give them All permissions on object contact in that OU but
>> they are still not able to create new ones.
>>
>> Can you help me out ?
>>
>> Sincerely
>>
>> \Jonas B
>>
>
>



Posted by neo [mvp outlook] on April 20, 2008, 12:31 am
Please log in for more thread options
Microsoft Exchange 200x in the environment? Reason I ask is that e-mail
enabling a contact so it shows in the Global Address List requires some
additional steps.

> Adding contact works fine but when they try to establish an Email address
> they are not allowed, and in my case they are adding them to establish an
> SMTP address, thats why they add an contact.
> Could you help me there too ?
>
> \Jonas B
>
>> Our site went the route of creating a custom delegwiz.inf file that
>> allowed us to use delegate wizard to dish out the appropriate rights the
>> group should have on said OU. Here is a copy of our custom inf file.
>> You would be interested in template 240.
>>
>>
>> [Version]
>> signature="$CHICAGO$"
>>
>> [DelegationTemplates]
>>
>> Templates = template130,template140,template180,template210,template240
>>
>>
>> ;----------------------------------------------------------
>> [template130]
>> AppliesToClasses=organizationalUnit
>>
>> Description = "Create, delete, and manage user accounts"
>>
>> ObjectTypes = SCOPE, user
>>
>> [template130.SCOPE]
>> user=CC,DC
>>
>> [template130.user]
>> CONTROLRIGHT= "Reset Password"
>> @=WP
>>
>> ;----------------------------------------------------------
>>
>> ;----------------------------------------------------------
>> [template140]
>> AppliesToClasses=organizationalUnit
>>
>> Description = "Create, delete, and managed groups"
>>
>> ObjectTypes = SCOPE, group
>>
>> [template140.SCOPE]
>> group=CC,DC
>>
>> [template140.group]
>> @=WP
>>
>> ;----------------------------------------------------------
>>
>> ;----------------------------------------------------------
>> [template180]
>> AppliesToClasses=organizationalUnit
>>
>> Description = "Create, delete, and manage computer accounts"
>>
>> ObjectTypes = SCOPE, computer
>>
>> [template180.SCOPE]
>> computer=CC,DC
>>
>> [template180.computer]
>> CONTROLRIGHT= "Reset Password"
>> @=WP
>> ;----------------------------------------------------------
>>
>> ;----------------------------------------------------------
>> [template210]
>> AppliesToClasses=organizationalUnit
>>
>> Description = "Create, delete, and manage an OU"
>>
>> ObjectTypes = SCOPE, organizationalUnit
>>
>> [template210.SCOPE]
>> organizationalUnit=CC,DC
>>
>> [template210.organizationalUnit]
>> @=WP
>> ;----------------------------------------------------------
>>
>> ;----------------------------------------------------------
>> [template240]
>> AppliesToClasses=organizationalUnit
>>
>> Description = "Create, delete, and manage contacts"
>>
>> ObjectTypes = SCOPE, contact
>>
>> [template240.SCOPE]
>> contact=CC,DC
>>
>> [template240.contact]
>> @=WP
>> ;----------------------------------------------------------
>>
>>
>>>I want a group of users to be able to add new contacts under a specific
>>>OU but I can't find out how ? I don't want them to be able to create new
>>>users and groups.
>>> I'v tried to give them All permissions on object contact in that OU but
>>> they are still not able to create new ones.
>>>
>>> Can you help me out ?
>>>
>>> Sincerely
>>>
>>> \Jonas B
>>>
>>
>>
>
>



Similar ThreadsPosted
Blocking Specific IP Addresses July 18, 2006, 12:37 pm
Deny Specific Subnet Access to DC July 17, 2006, 4:06 pm
allow start/stop a specific service through GPO November 14, 2006, 8:37 am
Exclude Specific Groups From Auditing? February 14, 2008, 8:39 am
AppCompat, TLB invalidation, CPU specific issues vs. security? May 12, 2008, 7:25 pm
How to non-trusted users write files to specific location December 15, 2005, 3:42 pm
Finding Which Application Requires Specific User Privilege? December 26, 2006, 3:17 am
Finding all ntfs folders showing a specific group in ACL... March 26, 2008, 4:43 pm
Restricting RDP to 2k3 DCs to only specific admins and not the entire admin group May 29, 2008, 11:39 am
IPSec - allowing access to specific ports on specifc IP addresses March 11, 2008, 4:27 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap