Service Account granted Full Control to users Home Directory

Question

I have a Business Rule where "After User Creation", "Create the home directory".

This works fine and adds the user Modify Access to their home directory, but it also Adds the service account with Full Control access to the folder.

This is not desirable as the account is already an administrator and does not need to be given explicit access.

Is there a way to suppress this behavior?

Answer 1

Hello,

You cannot configure Adaxes not to add the explicit permissions, but you can revoke them immediately after creating the home directory. To do this, you need to modify your Business Rule that creates the home directory:

1. Launch Adaxes Administration Console.
2. Navigate to and select your Business Rule that creates the home folders.
3. Right-click the action that creates the home folders and click Add New Action.
   
4. Paste the following script from the repository: Remove permissions for Adaxes default service administrator to access user's home directory.
5. Select Run a program or PowerShell script.
   
6. Enter a short description and click OK.
7. Save the Business Rule.

Comments

Hi,

I have applied this script but I am getting the error:

[!] Cannot find path \\homedrivehere because it does not exist.
[!] Cannot bind argument to parameter 'AclObject' because it is null.

---

Hello,

It looks like the account that is used to run the script does not have sufficient permissions to access the home directory. The account is specified in the Run As section of the Run a program or PowerShell script action that is used to run the script. By default, the account of Adaxes default service administrator (the user that you specified during Adaxes installation) is used.

To remedy the issue, you can use one of the following options:

• Grant the necessary permissions to the account that is used to run the script.

• Specify an account that has sufficient permissions to access home directories and modify permissions. To do this:

  1. In the Run As section, select This account.
  2. Click Specify.
     
  3. Specify an account that has sufficient permissions and click OK.
  4. Save the changes.

---

Hi, sorry for not replying sooner but I have been rather busy.

I tried the updated script, and the results are the same. The Local Administrators group and the account used to Login to the Domain permissions are still explicitly listed as in my previous post.

---

Hello,

Can you view the account used to login to the domain in the Administration Console and check whether the user Logon name property is populated for that account?

Also, you never mentioned that the local Administrators group should be removed from the list. Should the permissions for the local Administrators group also be removed?

---

Ah, I figured it out. I had restricted Adaxes from all service accounts in my licensing so it could not control the object.

My bad. You can mark this as Solved.