Delegating account unlock rights in AD

Question

I'm trying to delegate the rights to unlock user accounts in our Active Directory domain. This should be easy, and I've done it before... but every time the user tries to unlock an account (using the LockoutStatus tool), he gets denied with the error "You do not have the necessary permissions to unlock this account."

Here's what I've done:

• I created a domain local group and added the members who should have the rights. This was created over a week ago, so the users have logged out and in again.
• In ADUC, I've used the Delegate Rights wizard on the OU which contains our user accounts to grant permissions to Read lockoutTime and Writer lockoutTime to the group, per MSKB 279723
• I have double-checked the permissions were applied correctly in ADSIEdit.
• I have forced replication between all domain controllers to ensure the permission changes were copied over.
• The user testing it has logged out and in again to ensure he has any changes applied to his account.

...That covers all the bases I can think of. Anything else I could be missing?

Solution 1

If you are facing problem with admin accounts then it might be related to permissions getting reset every hour basis due to AdminSDHolder

Details

Solution 2

Have you verified the admins in question have not been explicitly denied access to that attribute through membership of another group?

Comments

[Shanmugalakshmi]

If possible, can you try to give the user the ADUC MMC and see if they can unlock the account that way? It's possible the LockoutStatus tool is trying to use some other permission that your user doesn't have for whatever reason.

[ewall]

That's a good idea, Paul. I'll give it a try sometime...