IT Employment·20,064 discussions

Restrict User Account Enabling

Locked

Within Active Directory security, is there a way to restrict a help desk group’s ability to enable user accounts after they have been disabled by a LAN Admin?

Topic

Perhaps

In reply to Restrict User Account Enabling

It all depends on how you enabled management of the OU containing the user accounts.

If you used the built-in Microsoft method of administering domains, the answer is no.

If you are using a third-party security tool, you perhaps can revoke that permission.

The best policy is to create an OU and call it Disabled Accounts and move the user account into that OU after they have been disabled. Do not grant the help desk permissions to manage that OU.

Reply To: Restrict User Account Enabling

In reply to Perhaps

Thanks for the suggestion about creating an OU called Disabled Accounts. That is a great idea.

That is what I will do. 🙂

[Author]

Replies