Granting a user admin rights for computer binding only

Our OD is configured to require authentication when binding a computer to the directory. We want to give this responsibility to the help desk department but we do not want them to have the "diradmin" password. We also do not want them to be able to modify users/groups. They should only be able to bind computers. Is this possible?

Leif Carlsson wrote:
Any OD user is supposed to be able to bind computers to the OD up to 10 times.
I haven't really tried this and is also interested in knowing if there is an ability to have what you are asking for.
Do you have any documentation to support that? I can't support that claim. Below I will post a log of a user (y000xyz) being created by diradmin then being denied when binding a computer via "Directory Utility" with the error "y000xyz is not an administrator"
Apr 22 2010 06:29:42 AUTH2: {0x4bcde0fe6b8b45670000000200000002, diradmin} DHX authentication succeeded.
*Apr 22 2010 06:29:42 NEWUSER: {0x4bcde0fe6b8b45670000000200000002, diradmin} created new user {0x4bd04f463531a0290000000d0000000d, y000xyz}*
Apr 22 2010 06:30:09 RSAVALIDATE: success.
Apr 22 2010 06:30:09 AUTH2: {0x4bd04f463531a0290000000d0000000d, y000xyz} DHX authentication succeeded.
Apr 22 2010 06:30:09 RSAVALIDATE: success.
Apr 22 2010 06:30:09 USER: {0x4bd04f463531a0290000000d0000000d, y000xyz} is the current user.
Apr 22 2010 06:30:09 AUTH2: {0x4bd04f463531a0290000000d0000000d, y000xyz} CRAM-MD5 authentication succeeded.
Apr 22 2010 06:30:11 RSAVALIDATE: success.
Apr 22 2010 06:30:11 AUTH2: {0x4bd04f463531a0290000000d0000000d, y000xyz} DHX authentication succeeded.
Apr 22 2010 06:30:11 RSAVALIDATE: success.
Apr 22 2010 06:30:11 USER: {0x4bd04f463531a0290000000d0000000d, y000xyz} is the current user.
Apr 22 2010 06:30:11 AUTH2: {0x4bd04f463531a0290000000d0000000d, y000xyz} CRAM-MD5 authentication succeeded.
*Apr 22 2010 06:30:11 CHANGEPASS failed because {0x4bd04f463531a0290000000d0000000d, y000xyz} is not an administrator.*
Message was edited by: iSauce

Similar Messages

Grant user admin rights, install itune, ungrant rights?

On Windows XP, installing iTunes requires admin rights. However, it is not good to use an admin account for regular work. For the Palm Desktop, the workaround was to grant admin rights to the user account, install the application using the user-turn-admin account, then ungrant admin rights. Will this last step cause problems for iTunes, or does iTunes require admin rights for its regular operation (outside of being installed)?

Actually, I can't find the thread! But the solution is that installing it as Admin still lets it be used by other user accounts, and each user account.

Problems Managing User Access Rights for Web Gallery

Has anyone else had issues changing the user access rights for a web gallery? It seems like the access is everyone or no one. Are the user rights handled per event in the gallery? I had issues adding events to the user's view/download rights in the publish settings.
Also, can these settings only be set when an event is first published? Attempting to change the user access rights after the event is published seems to require a re-upload of the images.
Any thoughts?

Problem solved.
I had to put the following lines in the specified "0000_any_80.my.website.conf" file:
        <Directory "/Library/WebServer/subdomain.domain">
                Options All +MultiViews -ExecCGI -Indexes -Includes
                AllowOverride None
                # For Password protection
                AuthType Digest
                AuthName "Password Protection"
                require valid-user
                <IfModule mod_dav.c>
                        DAV Off
                </IfModule>
        </Directory>

Can't update. Message says I don't have all permissions, yet have admin rights for imac running 10.5.8 & checked preference, security settings.

Trying to update. When I drag ff icon to apps folder message says replace or stop. Answer replace, then message says can't complete as I don't have permissions. I have full admin rights for imac running 10.5.8. I've reviewed preferences & security settings, FF is set to accept all incoming connections. Not sure what else to check.

If there are problems with updating or with the permissions then easiest is to download the full version and trash the currently installed version to do a clean install of the new version.
Download a new copy of the Firefox program and save the disk image (dmg) file to the desktop
*Firefox 9.0.x: http://www.mozilla.com/en-US/firefox/all.html
*Trash the current Firefox application to do a clean (re-)install
*Install the new version that you have downloaded
Your profile data is stored elsewhere in the Firefox Profile Folder, so you won't lose your bookmarks and other personal data if you uninstall and (re)install Firefox.
*http://kb.mozillazine.org/Profile_folder_-_Firefox

Urjent:Partition error:Logging out user [Admin], active for 0 minutes

Hi all,
Iam using 11
Wen iam creating Transaparent partition its validating successfully , but wen iam saving it its giving error , partition creation failed
Error: 1051037: Logging out user [Admin], active for 0 minutes
and it s giving error reading ddb file
i tried with maxl also but it continiously running for 30 mints , its horrible , actually it takes 2 mints
how can i resolve this issue, any help would be appriciated
thanks
Edited by: user8815661 on 26 avr. 2010 05:18
Edited by: user8815661 on 27 avr. 2010 04:00
Edited by: user8815661 on 3 mai 2010 04:18

Sounds like there is some sort of ddb file corruption. There are many causes, but the quickest fix I have found is usually a file-based deletion of the ddb file on both the source and target side of this partition. The attempt to create a partition on this database will cause a new ddb file to be created. Of course, this is dangerous. You can't have any other partitions on either the source or target side...or they will be deleted by this step. But the only purpose of the ddb file is for partition definitions, and it exists on both source and target.
I've found this happens if one side of a partition (one of the ddbs from source or target) gets the file deleted, or communication is down between the source database server and target database server.

I am interested in purchasing Adobe's Creative Suite 6 Master Collection for Mac and Windows (Single User Educational License) FOR STUDENTS & EDUCATORS ONLY.

I am interested in purchasing Adobe's Creative Suite 6 Master Collection for Mac and Windows (Single User Educational License) FOR STUDENTS & EDUCATORS ONLY. I am purchasing this program for my son who attends George Washington High School: The College Academy in New York, New York. He is a sophomore and is interested in web design. I would like to know if he is eligible to use/activate the Creative Suite 6 Master Collection for Mac and Windows (Single User Educational License) FOR STUDENTS & EDUCATORS ONLY prior to my purchase.

Peru Bob makes a good point. I just assumed the OP understood what the System requirements | Adobe Creative Suite 6 were.
Nancy O.

Setting up security and such for wireless router wrt54g without admin rights (work computer)

We are moving, I am in a new location with a new company and my only computer is this one from work. Trying to get my home network setup, I'm locked out of admin rights on this thing and am trying to set up the above router. I thought I had a modem problem at first, but finally I am online wired for now to the cable modem. I would like to get this router up and running, but I can't use the easy setup disk, and I just tried using the easy setup download and it is locked out as well. How can I get my router setup with security, with no admin rights on the pc?
This will be my first wireless router, so I am very green on the specifics and terminology. Any help is most appreciated.
Many thanks,

Thank you toomanydonuts!
I will do this when I get back to the townhouse this evening.
Just so that I am prepared for tonight - I want to confirm and ask a few questions on the "options" and note a couple things I noticed that may help with answers...
Internet connection type - should be easy, I assume there is a "cable modem" option.
SSID - I do not know what this means or what to choose
wireless encryption method (WEP, WPA, WPA2) - Which is best, or is there one I must pick due to computer used and such, I also want to get my Nintendo Wii accessing correctly, I saw these options on that setup, though it didn't work per my first message on the board. I assume whatever encryption method used needs to be chosen for the Wii?
wireless encryption password - I think I can handle this one
A couple of notes -
this laptop has this always on radar looking for wireless connections - how can I name my router so I know it's mine, other than the fact that it is the strongest signal. Maybe that's a network setting?
Thanks again, glad I came here.
Edit: I suppose I should add, just to ensure - in order to do this process through the url provided above, I need to be ethernet wired through the router to the modem? in order to access last night, I was straight into the modem, didn't seem to work wired through the router.
Message Edited by Syxpack on 03-27-2008 05:25 AM

Is it can grant an admin right for special application ?(No Runas as Administrator)

Dear All
Background: We have an application which run on users group in server 2000 SP4 is normal.
We want upgrade the OS to Win7 , on the Win7 the application can not launch on normal users group.
I was try the properties of compatibility to server 2000 and choose "Run this program as an administrator" and edit the regedit key permission , both of all is not work on my case.
It is ok right-click the application and runas as administrator, but on the other hand I find runas administrator has some other error with the application.
May I know is it has a method can grant the admin right to special user when running special application ?
Regards All

Hi,
What application can not run in Windows 7? I think there is a application compatibility issue, so please attempt to run Program Compability troubleshooter.
Also, you said you got some error while you ran as administrator with runas command. And what are the errors?
RUNAS /user:<Username> Program
Based on my knowledge, we cannot grant the special user with admin right unless you add this special user to Administrators group. When a special user is running a application requiring administrator permission, it will prompt to input administrator username
and password.
Andy Altmann
TechNet Community Support

Removing User Admin Rights

I am currently assisting in managing a domain of 3-4000 users. All of our users have administrative privileges on their machines. We are looking into several different ways of removing these administrative rights for obvious security reasons.
I have read about privilege management software like Avecto, but it would be great if you could utilize something like Restricted Groups in Active Directory or SCCM 2012R2 to achieve this somehow.
I read about Restricted Groups here:
http://www.windowsecurity.com/articles-tutorials/windows_os_security/Using-Restricted-Groups.html
I am wondering if we can achieve this by deploying these Restricted Group GPO's. I understand that these GPO's are linked to computer accounts though, but from what I am under the impression I can restrict adding accounts to the admin group and explicitly
allow other accounts.
Our AD functional level is 2008R2 and 99% of our workstations are running Win7 32-bit. Has anyone had any experience removing user administrative rights without purchasing third-party software?

We are in the process of deploying Avecto Privilege Guard (new name is DefendPoint).
We are doing this in conjunction with revising our GPP-Local Users & Groups settings (which we decided to use some time ago, instead of using classic Restricted Groups).
You'll need to use some method (and GP seems to be a good one) to take control of the local Administrators group membership.
Avecto PG can/will block all attempts to modify that group (due to its anti-tamper protections), but, presumably like us, you will need to evict unauthorised members of that group, and then protect that group from further modifications.
We also found, that the anti-tamper protections of Avecto PG, even prevent GP from cleaning up the group members, and it was suggested to us by Avecto support, that we create Avecto PG policy which allows the LocalSystem to bypass the protection. (GP CSE's
like this, will run in LocalSystem context)
You don't need Avecto PG to remove admin rights, you can do it with Domain GP. But, how do you maintain that position/integrity? And, how do you then allow users to perform some tasks, tasks which require privilege but your organisation approves of those
tasks being performed by users, but Windows doesn't allow that?
There are many types of technical controls to implement "security" (if that is your goal), but, you will find that each and every control can be bypassed with enough time and effort. Especially if your users are the determined type of person, who
also considers that their need to "do that thing" will make them productive/happy - they will ignore all company policies in pursuit of that productivity/happiness (or so it seems to me from my experience)
IT Support efforts/costs will rise, not drop - we are seeing this already.
Hatred towards IT (both systems and the people in IT) is also rising.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

VS2010 Crystal 13 click-once deployment without user admin rights?

The only supported way of deploying our runtimes is to use one of our prepackaged msi's.
We do not have any documentation for manual deployment or anything that lists what specific dlls, registry settings, etc are needed to run specific configurations (ie web app vs windows apps).
Jason

As well as what Jason posted CR MUST have local PC Admin rights because we need to get past DEP/UAC etc. as well as be able to register the COM components, insert all of the registry keys required and the usual folder creation and file copying. Without it CR simply won't install properly and your app will never run. As noted in those other posts if you write a .NET app you have no choice but to use/set the native permissions and file distribution. If it's a WEB based app the you deploy it on each WEB server, users get a Viewer and Printer control through a browser download. But for Windows, it's a must.
IT departments have the ability to push out Special permissions for users to install software, not a CR configuration so check with your IT group or Microsoft and search on Profiles. So the each users doesn't need to be granted Admin rights to use it but they need it to install, assuming when installed it's set for All users. Other option is a local network Admin install on each PC. Not the nice way of doing things though.
Bottom line is because it's a Native .NET windows app you have no choice but to distribute all of CR's runtime and dependencies.
Don

Admin Rights for Adobe AIR apps

Which Admin rights are needed on a system to install a .AIR file on a system? In our Enterprise scenario users do not have Admin rights on the system. And whenever user tries installing an AIR app an error is thrown for the same. I want to know what are the least (Admin) rights that we need to give to a user on a WindowsXP system so that he can install air apps?

Hello,
Unfortunately, there isn't a simple answer to this question because AIR isn't in complete comtrol over the full set of files and registry keys touched during an install - we rely on Windows Installer for that. However you can find additional information about this at:
Does Installing an AIR Application Require Admin Rights?
What are Administrative Rights, Anyway?
You might also want to vote for this idea: Installation of Adobe AIR apps without having administrative privileges
Hope this helps,
Chris

SSRS 2012: The permissions granted to user '' are insufficient for performing this operation. (rsAccessDenied)

Hello
Can you please help me with this error that I'm getting with SSRS 2012. I've searched the forums and I can only find solutions for SQL Server 2008 and not 2012.
When I try to go to the url on our server
http://server:port/ReportServer, I get the following error.
"The permissions granted to user 'WW004\z0008x5e' are insufficient for performing this operation. (rsAccessDenied)".
Can you please help me troubleshoot this. I have not been able to find a solution.
Andy

Hi AndyMcV,
According to your description, when you try to go to the URL
http://server:port/ReportServer, the error occurred: The permissions granted to user 'WW004\z0008x5e' are insufficient for performing this operation. In fact, reporting Services uses role-based security to grant user access to a report server, and there
are two types of roles: Item-level roles and System-level roles. On a new installation, only local administrators have access to a report server. In order to grant access to visit the URL
http://server:port/ReportServer to users, a local administrator must create a role assignment to define the tasks a user can perform. To workaround this issue, please refer to the following steps:
Start Report Manager by going to URL
http://server:port/ReportServer.
Click Site Settings at the top right of the page.
Click Security in the left pane.
If a role assignment already exists for the user, click Edit.
Otherwise, click New Role Assignment. In user, enter the user account.
Select appropriate access, and then click Apply.
Besides, if the user need to have access to reports, folders, models and shared data sources, we can assign Item-level roles on the root node (the Home folder) or on specific folders or items.
For more information about Role Assignments, please refer to the following article:
http://technet.microsoft.com/en-us/library/aa337471(v=SQL.105).aspx
If you have any questions, please feel free to let me know.
Thanks,
Wendy Fu

The permissions granted to user '' are insufficient for performing this operation._

We have just installed a new instance of ss2012 on windows server (2008r2), both myself and another BA are in the server administrator group and can create projects and reports. But when we try to deploy we get this error..
The permissions granted to user 'Domain\Username' are insufficient for performing this operation.

Hi ghw123,
According to your description, you can't deploy report onto report server, even the current user is the local server administrator. Right?
In this scenario, since you are the system administrator of Reporting Services, you supposed to be assigned Content Manager role already. Please go to SQL Server Management Studio, connect Reporting Services, go to Security->Roles->Content Manager,
check if this item level role has permission for all tasks.
If you have any question, please feel free to ask.
Best Regards,
Simon Hou

Is it really necessary not to have admin rights for security reasons

I was told that i need to create a second admin account then log into that, then from there take away my admin privileges.. so I would not be an admin so computer will be much safer.
Which i did
But then so many passwords all the time.. need to insert the admin password for so many things and it is annoying it is like vista which i don't like at all.
is this really important to keep computer secure?
what are your leopard security tips?

anteros27 wrote:
I was told that i need to create a second admin account then log into that, then from there take away my admin privileges.. so I would not be an admin so computer will be much safer.
Which i did
But then so many passwords all the time.. need to insert the admin password for so many things and it is annoying it is like vista which i don't like at all.
what are your leopard security tips?
You should have left your original account alone and created a second non-admin user account for day-to-day use. Any non-system apps you need, etc, you can install in the new account.
It's not easy switching horses in mid-stream so to speak, but it is safer than always using the computer as an administrator.
If you use Fast Switching, you can quickly access the original account anytime you wish.
is this really important to keep computer secure?
Yes. Security should come before convenience.
Again, you are getting all this requests for passwords because you changed you main account rather than creating a new one.
Browse this thread
http://discussions.apple.com/thread.jspa?threadID=1798675&tstart=0
Message was edited by: nerowolfe

The permissions granted to user '' are insufficient for performing this operation. (rsAccessDenied)

when I try to connect to the "http://localhost:8080/ReportServer " I get this error.
The permissions granted to user 'DOMAIN/USERNAME' are insufficient for performing this operation. (rsAccessDenied).
I have configered the Reporting services Configuration manager.
I am an administrator on my machine and on the reportserver DB. when I try to log on the my 2008 R2 reporting services I get a simalar error.
does any one have an idea of what I am missing?
thank you.
Jeff
Jeff

Hi There
Please also have a look on this thread
http://tanveeronline.blogspot.co.nz/2011/07/ssrs-2008-r2-unable-to-connect-to.html
http://social.msdn.microsoft.com/Forums/hu-HU/sqlreportingservices/thread/f8a0a3f5-3985-4356-8404-3b408f790747
http://www.networksteve.com/enterprise/topic.php?TopicId=24217
In the last section of this thread it get resolved by
"Changing the ports. Configured TCP port to 9000 and SSL port to 9001.
And then
<Add Key="SecureConnectionLevel" Value="0"/>
Its value was 2, changed it to 0."
Please have alook on this thread that might help you
Many thanks
Syed
http://tanveeronline.blogspot.co.nz/2011/07/ssrs-2008-r2-unable-to-connect-to.html
Does not work. I already had the settings which are mentioned in that blog -
Try doing the following things
Go to Reporting Services Conf. Manager.
1. Change the server account to local account.
2. Remove the SSL if configured.
3. Go to C:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services\ReportServer
4. Change the SecureConnectionLevel value to 0 in rsreportserver.config
Try refreshing the page, it should work now!
Also tried answer at - http://social.msdn.microsoft.com/Forums/sqlserver/en-US/f8a0a3f5-3985-4356-8404-3b408f790747/ssrs-2008-unable-to-connect-to-remote-server?forum=sqlreportingservices
Same thing there. SecureConnectionLevel value to 0 is already set for me.
Third link comment at end says -
Hi Chaitanya, Changing the ports worked for me. Configured TCP port to 9000 and SSL port to 9001. And then <Add Key="SecureConnectionLevel"
Value="0"/> Its value was 2, changed it to 0. Thanks for all your support Best Regards, Arka Mitra.
You can set TCP and SSL like this from Reporting services config manager -
Web Service URL option (left pane) > Advanced settings button > put the values.
The TCP can be changged to 9000, but the SSL requires a certificate file. I am stuck here.
The clue to make your own SSL certificate is here -
http://johnhennesey.blogspot.com/2010/10/reporting-services-2008-over-ssl.html
But, this post is not for windows 7 64 bit, ie my personal pc os. I tried to make the cert on win, 7, but options are complicated. Lets see.
Here is the issue for the same - https://stackoverflow.com/questions/22314341/cannot-see-self-created-certificate-in-certmanager

Granting a user admin rights for computer binding only

Similar Messages

Maybe you are looking for