AD - Prevent reenabling of objects in specific OUs

[googlemad]

We have several OUs for Disabled users (after 6 months etc.), the trouble is our helpdesk team just keep enabling the objects in there if the staff come back rather than moving them back to a more relevant department OU which obviously then becomes a nightmare for maintenance!

 

So I was hoping there might be a way to set those OUs so only disabled objects can end up in them, and accounts have to be moved out of them before they can be enabled again?!

[pantscat]

I don't think you can do this without doing some quite in-depth fiddling with adsiedit...

 

I'd argue it's just a training issue and performance manage them if they keep doing it!

[Steve21]

Modify the permissions on the OU so helpdesk group can move but not modify accounts? (Pretty sure you can do the create/delete route without modify but would have to double check it)

 

Steve

[Farloch]

I'd argue it's just a training issue and performance manage them if they keep doing it!

 

Totally agree.

 

Public birching in the school yard for the next offender ;-)

[sted]

could you apply a gpo to the ou that denies those users logon rights

[pantscat]

@sted... that's nice thinking.

 

I still like the public birching idea though.

[googlemad]

I like the GPO idea, it'll soon make them wake up a bit then when they have to deal with another ticket from the user once their account has been 'enabled' again

 

Sadly sometimes I would get a better response talking to a brick wall!

[3s-gtech]

I like the GPO idea, it'll soon make them wake up a bit then when they have to deal with another ticket from the user once their account has been 'enabled' again

Cue them deleting/disabling the link on the GPO