SoftwareCentral · AD delegation

Delegation for User objects

Give the SoftwareCentral account the rights it needs to manage user accounts in Active Directory: creating, moving and deleting users, enabling, disabling and unlocking them, and resetting their passwords.

Create and delete users Reset passwords Full Control

1 What the delegation is for

SoftwareCentral manages user accounts in Active Directory. This delegation covers all of these actions, so you cannot give one of them without the others.

What SoftwareCentral doesWhere it happens
Create a userIn the AD user window.
Change the properties of a userIn the AD user window.
Move a user to another OUIn the AD user window.
Delete a userIn the AD user window. The user object is removed from Active Directory.
Enable, disable or unlock a userIn the AD user window, and on the password reset page.
Reset a password, with or without change at next logonOn the password reset pages. The password is set and the lock-out is cleared.

2 Which account to delegate to

Give the delegation to the account that SoftwareCentral uses to sign in to Active Directory, not to a person's own account.

SituationAccount to delegate to
The server's own domain, and any other domain where the server's domain and that domain are both TrustedThe application pool account, set under Settings › General Settings › Server Configuration in Application Pool Username.
Any other domain where the server's domain or that domain is not TrustedThe Service Account in that domain's row under Settings › Domain › Domains.

In the steps below, the SoftwareCentral service account means this account, written as for example CONTOSO\svc-swc.

3 Delegate Full Control on user objects

Do these steps in Active Directory Users and Computers, once for each domain. The values in the pictures are examples, and the domain and account names are masked.

StepWhat you doScreen
1 Open Active Directory Users and Computers.  
2 Right-click the domain, then select Delegate Control….
Active Directory Users and Computers: the right-click menu of the domain, with Delegate Control in the list
Right-click the domain, then Delegate Control….
3 Click Next.
Delegation of Control Wizard, welcome page, with the Next button
The welcome page. Click Next.
4 Click Add.
Delegation of Control Wizard, Users or Groups page, with an empty list and the Add button
The Users or Groups page. Click Add.
5 Enter the SoftwareCentral service account in Enter the object names to select, then click Check Names.
Select Users, Computers, or Groups dialog: From this location shows the domain, and the service account is entered in Enter the object names to select
Enter the account, then click Check Names.
6 Click OK.
Select Users, Computers, or Groups dialog with the account resolved to its full name
The account is resolved. Click OK.
7 Click Next.
Delegation of Control Wizard, Users or Groups page, with the service account in the Selected users and groups list
The account is in Selected users and groups. Click Next.
8 Select Create a custom task to delegate, then click Next.
Tasks to Delegate page with Create a custom task to delegate selected
Select Create a custom task to delegate.
9 Select Only the following objects in the folder. Tick User objects, then tick Create selected objects in this folder and Delete selected objects in this folder. Click Next.
Active Directory Object Type page: Only the following objects in the folder is selected, User objects is ticked, and both Create and Delete selected objects are ticked
Tick User objects and both options at the bottom.
10 Select Full Control, then click Next.
Permissions page with Full Control at the top of the list
Select Full Control.
11 Click Finish.
Completing the Delegation of Control Wizard: the summary shows the domain, the service account and the permissions
The summary. Click Finish.

4 Best practice

  • Narrow the scope. Full Control on user objects lets the account reset passwords, disable and delete every user in the scope. Delegate on the OUs that hold the users SoftwareCentral manages, not on the whole domain, if you can.
  • Leave administrator accounts out of the scope. If an OU holds administrator accounts and it is in the delegation, SoftwareCentral can reset their passwords. Keep those OUs outside the delegation.
  • Include every OU that SoftwareCentral moves users to. A move needs rights on the destination OU as well as the user.
  • Check the first password reset. A successful reset writes Successfully changed password for user '…'. to the Log. If that line does not appear, the reset did not happen.

5 Troubleshooting

The messages are written to the Log. Find the entries for Active Directory there.

SymptomCauseWhat to do
Failed to reset password for user '…'. The account cannot set the password of that user. Usually the user is outside the delegated OUs, or it is a protected administrator account. The password may also not meet the domain's password policy. Check the OU of the user and that the account has Full Control there. Try a password that meets the policy.
Failed to unlock user '…'., Failed to enable user '…'. or Failed to disable user '…'. The account cannot change the user object. Check that Full Control on User objects applies to the OU of the user, as in step 9.
Failed to set user must change password at next login for user '…'. The account cannot change the user object. As above.
Failed to create AD user by name '…' The account cannot create user objects in the OU that was chosen. Add Create selected objects in this folder for User objects on that OU, as in step 9.
Failed to delete user by distinguished name '…' The account cannot delete the user object. Add Delete selected objects in this folder for User objects on the OU of the user, as in step 9.
Could not get directory entry at domain … SoftwareCentral cannot connect to that domain with the account that is set for it. Check the Service Account, Password and Port Number of the domain under Settings › Domain › Domains.