Set-aduser : Insufficient access rights to perform the operation

I am a domain admin, enterprise admin, exchange admin, domain user, and others.
While running a PS on a DC as the administrator, The commands I'm running are ...
$expdate = get-date -date '01/01/2014'
set-aduser -identity testmail5 -accountexpirationdate $expdate
I get the following error ...
set-aduser : Insufficient access rights to perform the operation
At line:1 char:1
+ set-aduser -identity testmail5 -accountexpirationdate $expdate
    + CategoryInfo          : NotSpecified: (testmail5:ADUser) [Set-ADUser], ADException
    + FullyQualifiedErrorId : Insufficient access rights to perform the operation,Microsoft.ActiveDirectory.Management.Comm
   ands.SetADUser
I then switch to a different DC, the command 'might' work once, but will never run again in the same window.
Then I tried this ...
start-process powershell -verb runas
That gave me an additional PS window, and I then tried running the commands again.
Same error message.
So I tried the following command ...
$expdate = get-date -date '01/01/2014'
set-aduser -server XXDC03 -identity testmail5 -accountexpirationdate $expdate
Same error message.
Is there any way that I can get around this problem?
Please help.

Keep in mind that the account used to open the PowerShell session must be the same account you're using to open ADUC. The error message means that Set-ADUser is trying to set the attribute for the account, but it's failing. Make sure to test with multiple
different accounts, in case the access control list of the object you're trying to modify is the cause of the problem.
Your PowerShell syntax is valid, so this isn't really a scripting question but a security/directory services question.
-- Bill Stewart [Bill_Stewart]

Similar Messages

Keep Receiving: Error is: 'Insufficient access rights to perform the operation' When running script

Hello. I have a powershell script I run in our domain to disable AD accounts. Part of that also removes the users from all AD groups. That part of my script however keeps throwing up this Error is: 'Insufficient access rights to perform the operation'
error.
Now from our Exchange server if I run this script with powershell, things work fine. But running it on the domain controller is when I get this error. Thoughts?

Thanks Anna!
I was able to add this code below in to the script where it kept erroring out and it then worked. I had to point it to a different DC then it was running on.
–Server comp1.test.server.com
Thanks again!

Lync Server Control Panel : Insufficient access rights to perform the operation;

Hi team,
I have a strange problem in managing Lync users through control panel. But I can enable/disable and Manage users through power shell. Am getting an error " Insufficient Rights to perform the operations" when i try through control panel
Please can someone help me urgently on tihs. I have all the users in a separate OU from where the RTC and CS groups are available. Is there any issue with the delegation?

Hi,
You will receive this error message when you attempt to manage Lync users who are members of protected admin groups in Active Directory (such as Enterprise Administrators etc.).
Typically I use Lync Management Shell, so don't get this error often as it only occurs in the Control Panel.
Editing the properties of the user object you are attempting to enable / disable in AD, and enabling inheritance on under the security tabs advanced options will also work around the problem, but you may not wish to do this. The inheritance change will revert
itself in 15 minutes or so I believe.
Perhaps someone can advise of an alternate solution through group membership / permissions, but as I don't have the issue often I've not looked into it at any great depth.
Kind regards
Ben
Blog:www.gecko-studio.co.uk/
Twitter:
LinkedIn:
Facebook:
Note: If you find a post informative, please mark it so using the arrow to the left. If it answers a question you've asked, please mark the thread as answered to aid others when they're looking for solutions to similar problems
or queries.

Orcladmin: "Insufficient access right to perform action" using oidadmin

After sucessfully installing OID from 8.1.7 CD on Sun Solaris 8
(SPARC) I can start the monitor and the oidldap. After
sucessfully connecting with orcladmin using oidadmin I always get
the same error (either using oidadmin on windows or solaris) when
accessing "entry management", "schema management" or "audit log
management":
Insufficient access right to perform action.
but the default ACP allows everyone (browse add delete)
anyone else had the same problem?
I tried to create the name server with OID with netca which
obviously does not work either.

Hi Christian:
You say that you conencted to OID as "oidadmin". Since OID does
not have any user account called "oidadmin" you were probably
conencted as an anonymous user. If you are trying to connect as
the administrator of OID the correct user account name is
"orcladmin" with a default password of welcome. Try this and let
me know if you sitll have troubles.
Thanks,
Jay Tomlinson

Insufficient Access Rights when trying to modify send as permissions on a public folder

Where I work, we have 2 mailbox database servers and 2 cas servers on Exchange 2010, upgraded from Exchange 2003. We are finding that when trying to grant a user send as rights to a publlic folder we are getting an Insufficient Access Rights error. The
bizzare thing is for one particluar folder we can amend the send as rights with no issue on one of the cas servers but not the other cas or either db servers.
You would have thought if it was a user permissions issue i.e the adminsitrator not having sufficent rights it would fail on every server and likewise if it was a problem with the folder itself, why is it working on one of the cas servers? Also on
the one server this particluar folder does allow us to amend the rights, when we try to amend others we get the same error
If anyone has come accross this before and knows a fix please share it.
Thanks

Hi,
Please check the ownership of the affected public folder to make sure it points to the right server.
Here is a similar thread which may help you, please following the suggests in this thread to check result.
https://social.technet.microsoft.com/Forums/office/en-US/0960b944-82b2-42f1-b438-a7d57b7ab783/insuffaccessrights?forum=exchangesvrgenerallegacy
Best regards,
Belinda Ma
TechNet Community Support

Dp* commands failed w/ SMSLdapObject: insufficient access rights to access

My dpadmin list/modify fails to execute. The amSMS log is below. What aci I lost? Any help is appreciated.
Regards
11/20/2005 03:17:15:659 AM MST: Thread[main,5,main]
SMSEntry: cache enabled: true
11/20/2005 03:17:16:023 AM MST: Thread[main,5,main]
SMSLdapObject: LDAP Initialized successfully
11/20/2005 03:17:16:349 AM MST: Thread[main,5,main]
Initialized LDAPEvent listner
11/20/2005 03:17:16:412 AM MST: Thread[main,5,main]
CachedSubEntries::getInstance DN: ou=DAI,ou=services,dc=sun,dc=com
11/20/2005 03:17:16:432 AM MST: Thread[main,5,main]
CachedSMSEntry::getInstance: ou=DAI,ou=services,dc=sun,dc=com
11/20/2005 03:17:16:441 AM MST: Thread[main,5,main]
SMSLdapObject.read() retry: 0
11/20/2005 03:17:16:451 AM MST: Thread[main,5,main]
WARNING: SMSLdapObject: insufficient access rights to access DN=ou=DAI,ou=services,dc=sun,dc=com
11/20/2005 03:17:16:461 AM MST: Thread[main,5,main]
ERROR: CachedSubEntries: unable to register for notifications:
Message:The user does not have permission to perform the operation.
at com.sun.identity.sm.ldap.SMSLdapObject.read(SMSLdapObject.java:231)
at com.sun.identity.sm.SMSEntry.read(SMSEntry.java:334)
at com.sun.identity.sm.SMSEntry.read(SMSEntry.java:326)
at com.sun.identity.sm.SMSEntry.<init>(SMSEntry.java:162)
at com.sun.identity.sm.CachedSMSEntry.getInstance(CachedSMSEntry.java:307)
at com.sun.identity.sm.CachedSubEntries.<init>(CachedSubEntries.java:72)
at com.sun.identity.sm.CachedSubEntries.getInstance(CachedSubEntries.java:204)
at com.sun.identity.sm.ServiceManager.getVersions(ServiceManager.java:409)
at com.sun.identity.sm.ServiceManager.serviceDefaultVersion(ServiceManager.java:427)
at com.sun.identity.sm.ServiceConfigManager.<init>(ServiceConfigManager.java:94)
at com.iplanet.am.sdk.AMCommonUtils.populateManagedObjects(AMCommonUtils.java:497)
at com.iplanet.am.sdk.AMCommonUtils.<clinit>(AMCommonUtils.java:113)
at com.iplanet.am.sdk.AMStoreConnection.<clinit>(AMStoreConnection.java:141)
at com.sun.portal.desktop.context.DSAMEConnection.<init>(DSAMEConnection.java:89)
at com.sun.portal.desktop.context.DSAMEAdminDPContext.init(DSAMEAdminDPContext.java:110)

- what's the complete command ?
- which user is used ?
/ulf

SMSLdapObject: insufficient access rights to access

The dpadmin command failed w/ SMSLdapObject: insufficient access rights to access. The amSMS log is below. What aci did I lose? Any help is appreciated.
Regards
11/20/2005 03:17:15:659 AM MST: Thread[main,5,main]
SMSEntry: cache enabled: true
11/20/2005 03:17:16:023 AM MST: Thread[main,5,main]
SMSLdapObject: LDAP Initialized successfully
11/20/2005 03:17:16:349 AM MST: Thread[main,5,main]
Initialized LDAPEvent listner
11/20/2005 03:17:16:412 AM MST: Thread[main,5,main]
CachedSubEntries::getInstance DN: ou=DAI,ou=services,dc=sun,dc=com
11/20/2005 03:17:16:432 AM MST: Thread[main,5,main]
CachedSMSEntry::getInstance: ou=DAI,ou=services,dc=sun,dc=com
11/20/2005 03:17:16:441 AM MST: Thread[main,5,main]
SMSLdapObject.read() retry: 0
11/20/2005 03:17:16:451 AM MST: Thread[main,5,main]
WARNING: SMSLdapObject: insufficient access rights to access DN=ou=DAI,ou=services,dc=sun,dc=com
11/20/2005 03:17:16:461 AM MST: Thread[main,5,main]
ERROR: CachedSubEntries: unable to register for notifications:
Message:The user does not have permission to perform the operation.
at com.sun.identity.sm.ldap.SMSLdapObject.read(SMSLdapObject.java:231)
at com.sun.identity.sm.SMSEntry.read(SMSEntry.java:334)
at com.sun.identity.sm.SMSEntry.read(SMSEntry.java:326)
at com.sun.identity.sm.SMSEntry.<init>(SMSEntry.java:162)
at com.sun.identity.sm.CachedSMSEntry.getInstance(CachedSMSEntry.java:307)
at com.sun.identity.sm.CachedSubEntries.<init>(CachedSubEntries.java:72)
at com.sun.identity.sm.CachedSubEntries.getInstance(CachedSubEntries.java:204)
at com.sun.identity.sm.ServiceManager.getVersions(ServiceManager.java:409)
at com.sun.identity.sm.ServiceManager.serviceDefaultVersion(ServiceManager.java:42 7)
at com.sun.identity.sm.ServiceConfigManager.<init>(ServiceConfigManager.java :94)
at com.iplanet.am.sdk.AMCommonUtils.populateManagedObjects(AMCommonUtils.java:497)
at com.iplanet.am.sdk.AMCommonUtils.<clinit>(AMCommonUtils.java:113)
at com.iplanet.am.sdk.AMStoreConnection.<clinit>(AMStoreConnection.java:141)
at com.sun.portal.desktop.context.DSAMEConnection.<init>(DSAMEConnection.jav a:89)
at com.sun.portal.desktop.context.DSAMEAdminDPContext.init(DSAMEAdminDPContext.jav a:110)

- what's the complete command ?
- which user is used ?
/ulf

Setting Item level access rights on sharepoint list item in ItemAdding event handler

Hi ,
I am using sharepoint 2013. I am trying to set item level access rights when a list item is added using the following code snippet,
public override void ItemAdding(SPItemEventProperties properties)
base.ItemAdding(properties);
ConfigureItemSecurity(properties);
private void ConfigureItemSecurity(SPItemEventProperties properties)
var item=properties.ListItem;
SPSecurity.RunWithElevatedPrivileges(delegate()
using (SPSite site = new SPSite(properties.SiteId))
using (SPWeb oWeb = site.OpenWeb())
item.ParentList.BreakRoleInheritance(true);
oWeb.AllowUnsafeUpdates = true;
var guestRole = oWeb.RoleDefinitions.GetByType(SPRoleType.Reader);
var editRole = oWeb.RoleDefinitions.GetByType(SPRoleType.Editor);
SPGroup HRGroup = oWeb.SiteGroups.Cast<SPGroup>().AsQueryable().FirstOrDefault(g => g.LoginName=="HR Team");
SPRoleAssignment groupRoleAssignment = new SPRoleAssignment(HRGroup);
groupRoleAssignment.RoleDefinitionBindings.Add(guestRole);
SPUserCollection users = oWeb.Users;
SPFieldUserValueCollection hm = (SPFieldUserValueCollection)item["HiringManager"];
SPFieldUserValueCollection pm = (SPFieldUserValueCollection)item["ProjectManager"];
SPFieldUserValueCollection pmChiefs = (SPFieldUserValueCollection)item["ProjectManagerChief"];
item.BreakRoleInheritance(true);
item.RoleAssignments.Add(groupRoleAssignment);
foreach (SPFieldUserValue staffMember in hm)
SetRightsOnItem(item, staffMember, editRole);
foreach (SPFieldUserValue staffMember in pm)
SetRightsOnItem(item, staffMember, guestRole);
foreach (SPFieldUserValue staffMember in pmChiefs)
SetRightsOnItem(item, staffMember, guestRole);
item.Update();
private void SetRightsOnItem(SPListItem item, SPFieldUserValue staffMember, SPRoleDefinition role)
SPUser employeeUser = staffMember.User;
var userRoleAssignment = new SPRoleAssignment(employeeUser);
userRoleAssignment.RoleDefinitionBindings.Add(role);
item.RoleAssignments.Add(userRoleAssignment);
Nothing is happening though... Is the event handler the right place to do this?
thank you

Hi ,
You can refer to the code working in my environment:
using System;
using System.Security.Permissions;
using Microsoft.SharePoint;
using Microsoft.SharePoint.Utilities;
using Microsoft.SharePoint.Workflow;
namespace ItemLevelSecurity.ItemSecurity
/// <summary>
/// List Item Events
/// </summary>
public class ItemSecurity : SPItemEventReceiver
/// <summary>
/// An item was added.
/// </summary>
public override void ItemAdded(SPItemEventProperties properties)
SPSecurity.RunWithElevatedPrivileges(delegate()
try
using (SPSite oSPSite = new SPSite(properties.SiteId))
using (SPWeb oSPWeb = oSPSite.OpenWeb(properties.RelativeWebUrl))
//get the list item that was created
SPListItem item = oSPWeb.Lists[properties.ListId].GetItemById(properties.ListItem.ID);
//get the author user who created the item
SPFieldUserValue valAuthor = new SPFieldUserValue(properties.Web, item["Created By"].ToString());
SPUser oAuthor = valAuthor.User;
//assign read permission to item author
AssignPermissionsToItem(item,oAuthor,SPRoleType.Reader);
//update the item
item.Update();
base.ItemAdded(properties);
catch (Exception ex)
properties.ErrorMessage = ex.Message; properties.Status = SPEventReceiverStatus.CancelWithError;
properties.Cancel = true;
public static void AssignPermissionsToItem(SPListItem item, SPPrincipal obj, SPRoleType roleType)
if (!item.HasUniqueRoleAssignments)
item.BreakRoleInheritance(false, true);
SPRoleAssignment roleAssignment = new SPRoleAssignment(obj);
SPRoleDefinition roleDefinition = item.Web.RoleDefinitions.GetByType(roleType);
roleAssignment.RoleDefinitionBindings.Add(roleDefinition);
item.RoleAssignments.Add(roleAssignment);
Thanks,
Eric
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected].
Eric Tao
TechNet Community Support

Error while configuring SSL in OID 11g - LDAP 50 Insufficient Access rights

HI,
I am trying to configure SSL in OID 11g.As per the doc http://download.oracle.com/docs/cd/E12839_01/oid.1111/e10029/ssl.htm#CBHGBGAF ,i tried creating a Self-Signed Wallte using Fusion Middleware control,But i am getting an error LDAP 50: Insufficient access rights".I logged into Fusion Middle Ware control as Weblogic user.Is anybody faced this issue?.Thanks in advance.

I am not sure how you tried, but I would recommend to do the following...
1. Add the 'user1' to "OU=Franchisees,ou=People,dc=company,dc=com"
2. Delete the 'user1' from 'OU=Internal,ou=People,dc=company,dc=com'

Insufficient access rights registering Oracle Directory Integration Server

Hi all!
following steps IÂ´ve done to use the Oracle Directory Integration Server.(IÂ´ve installed Oracle 10g infrastructure - OID is running - IÂ´m also able to apply successful with ODM and orcladmin account)
- oidctl connect=mydb1 server=odisrv instance=1 stop
- odisrvreg -h localhost -p 389 -D cn=orcladmin,cn=Users,dc=localhost;dc=com -w ,pass
where pass is the password of orcladmin.
-> now I get the following error:
registering..
Error javax.naming.NoPermissionException [LDAP:error code 50: Insufficient Access Rights]; remaining name 'cn=odisrv+orclhostname=maschine,cn=odi,cn=oracle internet directory' !
Any idea ??
Thanks for all help & comments.

I have gone through the documentation for creating the script. But there is one thing which I am not able to understand i.e. Subscription Parameters.
Can anyone tell me the use of subscription parameters? What is the role of subscription parameters in Oracle Lite and External Authentication.
Regards
Kapil

Subscribe : No access rights to perform action

Hi
There is one problem I am facing when an end user tries to subscribe to resource discussion. I get an error which says "<b>No access rights to perform action</b>". When I try the same operation with Super_Admin user it works perfectly fine. Please note that at the folder level both end user and administrator user has got same permission and service permissions. Also both Subscription and Collaboration_Subscription services are enabled for the said repository.
The same problem happens when user wants to subscribe to room discussions.
Any idea why end user is not able to subscribe ?
Best Regards
Prabhakar Lal

hi
I was able to solve the problem. The service permission on folder collaboration --> discussions has to be modified for end user.
Best Regards
Prabhakar Lal

Deduplication: There is insufficient disk space to perform the requested operation

Hello,
on my Win2012R2 Fileserver is a 550GB disk with userdrives.
I startet Data Deplication but after 100 Optimized Files the job stopped and I cannot start it again.
If I check the Event Log I find:
Data Deplication could not initialize change log under \\?\Volume{ID}}.... The error code was 0x8056530a, There is unsufficient disk space to perform the requested operation. (Event ID 4119)
Then I tried to unoptimize the files with Start-DedupJob -type Unoptimization -volume "E:" but I got another error:
HRESULT 0x8056533a, This kon will not run at the scheduled time because it requires more memory than is currently available.
On the 550GB disk I have about 140GB free diskspace.
The server have 8GB RAM and use 2,3GB at the moment.
CPU is at 0-2%
SYSTEM have full access on the drive, there is no SWAP or boot file on it.
Any more ideas?
I already tried a reboot... ;)
Thanks.
bye Manuel

Hi Sophia,
KB3000850 is installed, the server restarted. But I'm sorry to say, same situation:
PS C:\Windows\system32> Enable-DedupVolume "E:"
Enabled            UsageType          SavedSpace           SavingsRate
Volume
True               Default            26.95 MB             0 %
E:
PS C:\Windows\system32> Start-DedupJob -type Optimization -volume "E:" -wait
Type               ScheduleType       StartTime              Progress   State
Volume
Optimization       Manual
0 %        Failed                 E:
Eventlog:
ID 4119
Data Deduplication could not initialize change log under \\?\Volume{7a4277ad-72ee-11e4-80bf-0050569d1d6b}\System Volume Information\Dedup\Logs. The error code was 0x8056530a, There is insufficient disk space to perform the requested operation.
ID 4106
Data Deduplication warning: Available memory (4095 MB) is less than minimum required (4392 MB)
Error: 0x00000000, The operation completed successfully.
Volume E: is 549 GB and have 186 GB free
Memory is 2,6/8,0 GB at the moment
Best regards,
Manuel

Public folder migration 2010 to 2013 insufficient access rights

Hi,
I'm having a frustrating time with trying to migrate public folders. I've migrated all the mailboxes with no problems but when trying to migrate public folders with the same account it fails with this message;
Active directory response: 00002098: SecErr: DSID-03150BB9, problem 4003
(INSUFF_ACCESS_RIGHTS), data 0
--> The user has insufficient access rights.
The account is in the organisation management and recipient management group.
I've tried ticking the inherit permission box in AD security.
I've tried creating a brand new account with the same permissions.
Nothing works. I'm tempted just to export to pst and import it to the public folder mailbox.
Any help would be much appreciated.
Thanks

Hi Nick,
ensure that the new admin account has the allow inheritance permission included
Also ensure that the account has full rights to all the public folders in Ex2010
Go to the application log and there would be an event triggered for the same with some description. YOu can find that it might be failing permission on a particular public folder if so grant them access.
And also check if the permission failed public folder is mail enabled. If so please disable the mail enable on that PF cancel the migration request and start a new migration request with the below cmd
New-publicfoldermigrationrequest -sourcedatabase (Get-publicfolderdatabase -server servername -csvdata (get-content c:\contents.csv -encoding byte) -BadItemLimit 5000 -AcceptLargeDataLoss
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you.
Regards,
Sathish

When I try to sync my IPOD (3rd gen) on ITunes, I receive the following error message - you don't have enough access permissions to perform this operation

When I try to sync my IPOD (3rd gen) on ITunes, I receive the following error message - you don't have enough access permissions to perform this operation..can anyone assist?

See:
iPhone - not enough access privileges: Apple Support Communities

Access rights specifically on the repository

Hi,
Is it possibe to have a user id having access right only on the livecycle repository ? If yes then how ?
Somebody please help .

I'm not sure what you are asking. Rights Management is used to apply encryption, control access (authentication) and to enforce specific permissions (i.e. print, no print) on PDF amd MS Office documents.
It is not used to control access to a repository, but is can protect documents in a repository.
Hope this helps.
Steve

Set-aduser : Insufficient access rights to perform the operation

Similar Messages

Maybe you are looking for