Allow adding group members only via custom command

Question

Hi again : )

I would like to restrict adding members to specific groups only via Custom Command / Executed via PowerShell.

Why? We need information from Helpdesk like Ticket ID to check approval for adding users to groups. Since this is not possible by default at the moment, I created a custom command, allow only selection of specifc groups and ask for input.

Now I want to decline any operations from Adaxes done via Webinterface and not coming from the Custom command/script.

Is this possible? Let me know if you need more clarification and I am happy to share details.

Thanks!

Answer 1

Hello,

Yes, it is possible. You just need to deny the permissions to manage membership in the groups. The following tutorial will be helpful: https://www.adaxes.com/help/GrantRightsToModifyGroupMembership. Then you need to grant users the permissions to execute the custom command you have. once done, users will not be able to add/remove members from the groups in Adaxes except for using the custom command.

Comments

Ok, but this will deny managing membership in total, no? So Helpdesk can not remove users from group via classic way. I need to write another custom command for that?

---

Hello,

Yes, that is correct. As long as it is about modifying the very same property (Member), it is a single permission for both adding and removing members.

---

Ok, understood.

Will it be possible, to show only members of a selected group? At the moment, I select a group and have then the option to select every AD user... would be nice to limit this only to real members of the group.

---

Got it : )