Removing access to change specific groups

Question

We have a specific group in AD that we do not want people to be able to modify in Adaxes. Is there a way to restrict the ability to modify a specific group in Adaxes?

Answer 1

Hello,

Yes, it is possible. You will need to create a Security Role denying the permissions to modify properties of the group. The role disallowing midification of all group properties will look like the following: If you want to restrict modification of only specific group properties, have a look at the following tutorial: https://www.adaxes.com/tutorials_DelegatingPermissions_GrantRightsToModifySpecificProperties.htm. On step 3, select the Group object type and then select the Write <Property Name> permission in the Deny column. Finally, the role will look like the following:

Comments

I setup a Security Role as suggested and it does not appear to be working. For the Trustee I used the people I am testing with and the "Assigned Over" is the group I want to restrict. I tested with one of the people and they were still able to add users to this group. Here is was my Security Role looks like.

---

Hello,

Sorry for the confusion, the screenshot in the previous post was just an example. If you need to prohibit adding/removing members from the group, you need to add a deny permission for writing the Member property of the group. Finally, the Security Role will look like the following: