Restricting Licenses Objects by OU

Question

Is it possible to restrict entire OU's from licensing, rather than on a per-object basis?

We may have a requirement, due to a corporate merger, to remotely adminster a subsection of accounts in a '3rd party' AD. As they would still be capable of creating new accounts etc in 'their' bit if we can only filter specific objects we'd need to constantly update, so we'd be looking to exclude all OU's but those containing 'our' users etc.

Thanks

Answer 1

Hello,

Have a look at the following help article: http://www.adaxes.com/help/?HowDoI.Mana ... ounts.html. You need option Using a Scheduled Task and a script and the following script: http://www.adaxes.com/script-repository ... s-s178.htm.

Comments

Thanks - very helpful.

That said - the number of users within the AD domain that we will be managing is going to be <5% of the total (less than 1,000 out of 10,'s of thousands). I'm slightly concerned with the script trawling and disabling thousands of objects, rather than the other way - trawling and *enabling* hundreds (if that makes sense).

Do you know the impact on the DC for doing this?

---

Hello,

First of all, the script does not disable any users. It only adds them them to the Unmanaged Accounts list managed internally by Adaxes. Any accounts on that list are completely ignored by Adaxes. You won't be able to view them anywhere in Adaxes, and they are not included in the license count. From the point of view of native Active Directory tools, like ADUC or Exchange, for example, there will be no changes.

Secondly, since you are going to manage only a small portion of accounts in that AD, we can suggest an alternative solution that will suit your needs better. To manage an AD domain with the help of Adaxes, you need to register it. To do this, you need to specify an account whose credentials will be used to access the domain. Adaxes will use the account to perform any operations within the domain using the specified credentials and will be limited by the access permissions of the account you specify.

By default, an account of a domain administrator is required to register a domain, which grants Adaxes the permissions to view the whole domain. However, you can also register a domain using an account who is not an administrator. In your scenario, you can use an account that has permissions to view only the accounts you want to manage with the help of Adaxes. For information on how to enable registering domains using accounts of non-administrators, see the following help article: http://www.adaxes.com/help/?HowDoI.Mana ... mains.html.

---

Many thanks - that sounds like it could be a good alternate plan.

Apologies for using 'disable' rather than 'unmanage' - I was aware that this was the case, it was more about the amount of traffic that it would generate etc.

Rgds