Return
-
Title
Delegated full recovery permission to a domain user account, but the Active Directory object restore will not work -
Description
Delegated the permission to recover deleted (AD) Active Directory objects to a domain user that is not a member of the domain admins group, but it is not working.
Within the Active Administrator console under Configuration | Role Based Access, the domain user was given the Recovery permission:
-
Resolution
The role based access permissions are for access to the Active Administrator modules within the console only. Even though this domain user was given full access to the Active Administrator Recovery module, this does not give them the rights to restore deleted AD objects. The user would need to be delegated permissions to restore deleted AD objects, or added to administrative group that has the rights to do so.