Trying to find where a password change permission has been delegated

[Jaan]

Hi all,

Just anted to know if anybody could help,

 

The staff here us wisDATAman for changing student passwords https://wisedataman.com/password-control

 

There's a security group that has delegated access to allows Muggles to change student passwords. This currently all work fine and as intended, however i just wanted to check a couple of things from a security perspective.

 

I expected the delegate permissions to be on the 'Staff' OU in AD. however i can't find any evidence of this and i'm really struggling to find where this delegated access is attached.... not sure which OU. i've had a good look. Maybe i'm looking for the wrong thing.

 

I thought i'd see the 'password control security group' under AD OU--- Properties---security----advanced.

 

But no joy.

 

Any ideas?

[Davit2005]

At a guess I thought it would be on the OU where the students would be as that is where the staff are changing the user accounts??

 

Logic tells me this but we all know where IT systems can play with logic sometimes :-) . I've only done delegation for MDT to create computer accounts in a specific OU to avoid giving the service join account domain admin rights but I'm assuming would be same principle.

Edited February 17, 2023 by Davit2005

[bald_pig]

I'd have thought it would be the security tab for the students OU?

[Jaan]

I'd have thought it would be the security tab for the students OU?

 

OMG of course it is! found straight away after you both suggested that! Thank you!,

 

My mind set was staff need the permission rather than the permission is needed on the student OU.

 

Thank you once again...... i'm glad its friday!