Active Roles 8.2.1 - Built-in Access Templates Reference Guide

To delegate data management tasks for the resources stored in your Active Directory AD environment, use the Access Templates (ATs) in the root of the Configuration > Access Templates > Active Directory container of the Active Roles Console. Such data management tasks include managing users, groups, printers, or computers.

Table 1: Active Directory – General data management Access Templates
Access Template	Description
All Objects - Full Control	Grants full permission to perform any administrative operation on any object in AD. TIP: Use this AT to delegate complete permission to data administrators who are expected to carry out any and all AD content management tasks in your organization.
All Objects - Read All Properties	Grants the following permissions: List directory objects. View all properties of any object in AD.
All Objects - View or Restore Deleted Objects	Grants the permission to view or restore AD objects deleted from a container. TIP: Apply this AT to the container whose deleted objects the data administrators should be able to view or restore. For more information on how to configure ATs for resource objects in your organization with the Active Roles Console, see Applying Access Templates in the Active Roles Administration Guide.
Claim Types - Full Control	Grants full permission to: Create new claim types. Perform all administrative operations on existing claim types. Claim types determine the claims to issue for an AD security principal upon its authentication, and are used to define permissions when authoring claim-based access rules.
Claim Types - Modify All Properties	Grants permission to view or change all claim type properties.
Claim Types - Read All Properties	Grants permission to list claim types and view all claim type properties.
Computers - Create Computer Accounts	Grants the following permissions: Create new computer accounts. View all properties of computer accounts.
Computers - Full Control	Grants full permission to: Create new computer accounts. Perform all administrative tasks on existing computer accounts.
Computers - Modify All Properties	Grants permission to view or change all properties of computer accounts.
Computers - Move Computer Accounts	Grants the following permissions: Move computer accounts. View all properties of computer accounts.
Computers - Read All Properties	Grants the following permissions: List computer accounts. View all properties of computer accounts.
Computer - Reset Computer Accounts	Grants the following permissions: Reset computer accounts. View all properties of computer accounts.
Contacts - Create Contacts	Grants the following permissions: Create new contacts. View all contact properties.
Contacts - Full Control	Grants full permission to: Create new contacts. Perform all administrative operations on existing contacts.
Contacts - Modify All Properties	Grants permission to view or modify all contact properties.
Contacts - Modify Picture	Grants the following permissions: View or change the image, that is, the thumbnailPhoto attribute. View all contact properties.
Contacts - Read All Properties	Grants the following permissions: List contacts. View all contact properties.
Domains - Read All Properties	Grants the following permissions: List domain objects. View all properties of domain objects.
gMSA - Full Control	Grants full permission to: Create new group Managed Service Accounts (gMSAs). Perform all administrative operations on existing gMSAs.
gMSA - Modify All Properties	Grants permission to view or change all gMSA properties.
gMSA - Modify Membership Policy	Grants permission to view or change the list of computers and computer groups allowed to use a specific gMSA.
gMSA - Read All Properties	Grants the following permissions: List gMSAs. View all gMSA properties.
Groups - Add/Remove Members	Grants permission to view or modify the members of groups.
Groups - Create Groups	Grants the following permissions: Create new groups. View all group properties.
Groups - Full Control	Grants full permission to: Create new groups. Perform all administrative operations on existing groups.
Groups - Manage Dynamic Groups	Grants the following permissions: Configure rule-based membership rules for dynamic groups. View all group properties. List groups in AD containers. List AD containers.
Groups - Modify All Properties	Grants permission to view or modify all group properties.
Groups - Modify Picture	Grants the following permissions: View or change the image, that is, the thumbnailPhoto attribute. View all group properties.
Groups - Perform Deprovision Tasks	Grants the following permissions: Deprovision groups. View all group properties. TIP: Use this AT to delegate group deprovisioning permissions to data administrators without also delegating group create and group delete permissions.
Groups - Perform Undo Deprovision Tasks	Grants the following permissions: Restore groups. View all group properties. TIP: Use this AT to delegate the permission of performing the Undo Deprovisioning command on groups only.
Groups - Read all Properties	Grants the following permissions: List groups. View all group properties.
OUs - Create OUs	Grants the following permissions: Create new Organizational Units (OUs). View all OU properties.
OUs - Full Control	Grants full permission to: Create new OUs. Perform all administrative operations on OUs.
OUs - Modify All Properties	Grants permission to view or modify all OU properties.
OUs - Read All Properties	Grants the following permissions: List OUs. View all OU properties.
Printers - Full Control	Grants full permission to: Create new printer queue objects. Perform all administrative operations on existing printer queues.
Printers - Modify All Properties	Grants permission to view or modify all printer queue properties.
Printers - Read All Properties	Grants the following permissions: List printer queue objects. View all printer queue properties.
Shared Folders - Full Control	Grants full permission to: Create new shared folder objects. Perform all administrative operations on existing shared folders.
Shared Folders - Modify All Attributes	Grants permissions to view or modify all shared folder properties.
Shared Folders - Read All Properties	Grants the following permissions: List shared folders. View all shared folder properties.
Users - Create User Accounts	Grants the following permissions: Create new user accounts. View all user account properties.
Users - Delete User Accounts	Grants the following permissions: Delete user accounts. View all user account properties.
Users - Full Control	Grants full permission to: Create new user accounts. Perform all administrative operations on existing user accounts.
Users - Help Desk	Grants the following permissions: Reset user passwords. Unlock user accounts. Assign or remove digital (X.509) certificates from user accounts. View all user account properties. TIP: One Identity recommends using this AT to delegate permissions required for the day-to-day operations of your helpdesk service.
Users - Modify All Properties	Grants permission to view or modify all user account properties.
Users - Modify Personal Data	Grants permission to manage the basic HR-related properties of user accounts.
Users - Modify Picture	Grants the following permissions: View or change the image, that is, the thumbnailPhoto attribute. View all user account properties.
Users - Move User Accounts	Grants the following permissions: Move user accounts. View all user account properties.
Users - Pager & Cell Phone Numbers	Grants the following permissions: View and modify the mobile phone and pager number information of the user accounts. View all user account properties.
Users - Perform Deprovision Tasks	Grants the following permissions: Deprovision user accounts and other user-related resources. View all user account properties. TIP: Use this AT to delegate user deprovisioning permissions to data administrators without also delegating user create and user delete permissions.
Users - Perform Undo Deprovision Tasks	Grants the following permissions: Restore user accounts. View all user account properties. TIP: Use this AT to delegate the permission of performing the Undo Deprovisioning command on user accounts only.
Users - Phone Number & Address	Grants the following permissions: Modify the address and telephone number properties of user accounts. View all user account properties.
Users - Read All Properties	Grants the following permissions: List user accounts. View all user account properties.
Users and Groups - Basic Management	Grants the following permissions: List groups and user accounts. Add or remove users and groups to or from groups. Reset user passwords. View or modify the login-related properties of user accounts.

Active Roles 8.2.1 - Built-in Access Templates Reference Guide

Introduction

About built-in Active Roles Access Templates

Active Directory

Active Directory – General ATs

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Active Roles 8.2.1 - Built-in Access Templates Reference Guide

Introduction

About built-in Active Roles Access Templates

Active Directory

Active Directory – General ATs