Voltar
-
Título
How to prevent a group's members from being modified? -
Descrição
How to create an AD Protection Template to prevent a group from having is members modified (add or delete). -
Resolução
To create the Protection template to prevent changes to a groups list of members:- Open the Change Auditor Client
- Click View | Administration
- Click Protection in the bottom left
- Click Add from the tool bar
- Provide a name for the template
- Locate the group(s) you want to add to the template by using the Browse or Search functions. Select each group and click Add
- In the bottom window, where the name of the group(s) now appear, click the drop-down under Operations and uncheck 'Create' and 'Delete'
- Click Next
- Select 'Only Selected'
- Under Attributes, click where is states 'Click here to filter data', click and type the word member
- Click member in the attribute list and click Add
- Click Next
- You can optionally select accounts that will be able to override the protection template and make changes to the member attribute of the group object(s) added to the template. If you do not add accounts that are permitted to access the protected objects, the group membership for those groups will never be able to be changed unless you modify the protection template
- Click Next
- You can optionally select specific accounts that are authorized to modify the AD Protection Template
Note: The CA Administrators always have the right to modify the templates, however if you add a user or group on the page for those who can modify the template, only those users or groups will be able to modify the template going forward. The CA Administrators will no longer be able to modify this specific template.
If any user or group you specify is NOT a member of the ChangeAuditor Administrators group, you will need to add them to the AD Protection Role in order for them to view the Administration Tasks tab to access Active Directory and Group Policy protection templates. For more information on adding members to the AD Protection role using the Application User Interface Authorization page (in the Configuration task list of the Administration Tasks tab), refer to the Change Auditor User Guide - Click Next through the rest of the wizard and then Finish