How would I enforce users only being added to a group I've created from a custom command / script?

Question

Hello,

We are currently rolling out a deployment for Windows Hello. For this, we have created a custom automation in Adaxes for users to have to reset their passwords on next login to something complex, then that new password is not required to be reset after the fact. They are then added to a group which is assigned to this password policy. Is there a good way to make sure users can only be added into this group via our script (we want to avoid people being added on accident), and for only our admins to be able to edit or see this group? Or, do you have another recommendation for getting this done?

Thank you.

Answer 1

Hello,

The easiest way is to just hide the group from everyone except for the users who actually need it. The following tutorial should be helpful: https://www.adaxes.com/help/HideObjectsFromUsers. At the same time, this will work only in Adaxes. Members can still be added to the group externally, e.g. via Active Directory Users and Computers. As such, you will need to eliminate such possibilities as well.

Comments

Thank you; if a user is blind to the group, will this prevent them from being added to the password policy / gropu itself via the automation?

---

Hello,

No, it will not influence the operation. It is just that the users will not se the group in Adaxes. At the same time, users with required permissions will be able to add members to the group.