Active Roles 8.1.5 - Built-in Access Templates Reference Guide

To help delegating administrative permissions for Active Directory (AD), Azure Active Directory (Azure AD), Exchange, Starling, or other miscellaneous resources in your organization, the Active Roles Console provides a set of built-in Access Templates (ATs).

With ATs, you can simplify the delegation of administrative tasks by assigning low-level permissions to your organizational resources, allowing administrators to manage them in the scope of the assigned ATs as a single unit.

With the built-in ATs of the Active Roles Console, you can:

Delegate the most typical administrative roles within your organization. For more information on how to assign ATs, see Applying Access Templates in the Active Roles Administration Guide.
Create your own custom ATs by using the built-in ones as a baseline. For more information, see Creating an Access Template in the Active Roles Administration Guide.

Active Directory

The Configuration > Access Templates > Active Directory container of the Active Roles Console contains Access Templates (ATs) for delegating Active Directory (AD) service and data management tasks, for example:

User and group management.
Computer, printer queue and shared folder object management.
Forest and domain configuration management.

This container has two sub-containers:

Advanced contains special AD ATs with very granular permissions. For more information, see Active Directory – Advanced ATs.
Best Practices for Delegating Active Directory Administration contains ATs for delegating service management to the most typical AD service management roles. For the list of these ATs, see Active Directory – Best Practices ATs.
- For more information about these best practices, their security sensitivity and impact, see the Microsoft Windows Server documentation.
- For more information on how to configure these ATs within the Active Roles Console, see the Description of the applicable AT.
IMPORTANT: Consider the following when configuring Active Directory ATs:
- To ensure that all appropriate permission entries are added to AD when configuring service management-specific ATs, always select the Propagate permissions to Active Directory option in the Permissions Propagation step of the Delegation of Control Wizard.
  
  Figure 1: Delegation of Control Wizard – Permissions propagation
  
  For more information on how to configure ATs for resource objects in your organization with the Active Roles Console, see Applying Access Templates in the Active Roles Administration Guide.
- Active Roles does not support configuring ATs for the Schema container. To do so, use native Microsoft tools, such as ADSI Edit.

Active Directory – General ATs

Active Directory > Active Directory – General ATs

To delegate data management tasks for the resources stored in your Active Directory AD environment, use the Access Templates (ATs) in the root of the Configuration > Access Templates > Active Directory container of the Active Roles Console. Such data management tasks include managing users, groups, printers, or computers.

Table 1: Active Directory – General data management Access Templates
Access Template	Description
All Objects - Full Control	Grants full permission to perform any administrative operation on any object in AD. TIP: Use this AT to delegate complete permission to data administrators who are expected to carry out any and all AD content management tasks in your organization.
All Objects - Read All Properties	Grants the following permissions: List directory objects. View all properties of any object in AD.
All Objects - View or Restore Deleted Objects	Grants the permission to view or restore AD objects deleted from a container. TIP: Apply this AT to the container whose deleted objects the data administrators should be able to view or restore. For more information on how to configure ATs for resource objects in your organization with the Active Roles Console, see Applying Access Templates in the Active Roles Administration Guide.
Claim Types - Full Control	Grants full permission to: Create new claim types. Perform all administrative operations on existing claim types. Claim types determine the claims to issue for an AD security principal upon its authentication, and are used to define permissions when authoring claim-based access rules.
Claim Types - Modify All Properties	Grants permission to view or change all claim type properties.
Claim Types - Read All Properties	Grants permission to list claim types and view all claim type properties.
Computers - Create Computer Accounts	Grants the following permissions: Create new computer accounts. View all properties of computer accounts.
Computers - Full Control	Grants full permission to: Create new computer accounts. Perform all administrative tasks on existing computer accounts.
Computers - Modify All Properties	Grants permission to view or change all properties of computer accounts.
Computers - Move Computer Accounts	Grants the following permissions: Move computer accounts. View all properties of computer accounts.
Computers - Read All Properties	Grants the following permissions: List computer accounts. View all properties of computer accounts.
Computer - Reset Computer Accounts	Grants the following permissions: Reset computer accounts. View all properties of computer accounts.
Contacts - Create Contacts	Grants the following permissions: Create new contacts. View all contact properties.
Contacts - Full Control	Grants full permission to: Create new contacts. Perform all administrative operations on existing contacts.
Contacts - Modify All Properties	Grants permission to view or modify all contact properties.
Contacts - Modify Picture	Grants the following permissions: View or change the image, that is, the thumbnailPhoto attribute. View all contact properties.
Contacts - Read All Properties	Grants the following permissions: List contacts. View all contact properties.
Domains - Read All Properties	Grants the following permissions: List domain objects. View all properties of domain objects.
gMSA - Full Control	Grants full permission to: Create new group Managed Service Accounts (gMSAs). Perform all administrative operations on existing gMSAs.
gMSA - Modify All Properties	Grants permission to view or change all gMSA properties.
gMSA - Modify Membership Policy	Grants permission to view or change the list of computers and computer groups allowed to use a specific gMSA.
gMSA - Read All Properties	Grants the following permissions: List gMSAs. View all gMSA properties.
Groups - Add/Remove Members	Grants permission to view or modify the members of groups.
Groups - Create Groups	Grants the following permissions: Create new groups. View all group properties.
Groups - Full Control	Grants full permission to: Create new groups. Perform all administrative operations on existing groups.
Groups - Manage Dynamic Groups	Grants the following permissions: Configure rule-based membership rules for dynamic groups. View all group properties. List groups in AD containers. List AD containers.
Groups - Modify All Properties	Grants permission to view or modify all group properties.
Groups - Modify Picture	Grants the following permissions: View or change the image, that is, the thumbnailPhoto attribute. View all group properties.
Groups - Perform Deprovision Tasks	Grants the following permissions: Deprovision groups. View all group properties. TIP: Use this AT to delegate group deprovisioning permissions to data administrators without also delegating group create and group delete permissions.
Groups - Perform Undo Deprovision Tasks	Grants the following permissions: Restore groups. View all group properties. TIP: Use this AT to delegate the permission of performing the Undo Deprovisioning command on groups only.
Groups - Read all Properties	Grants the following permissions: List groups. View all group properties.
OUs - Create OUs	Grants the following permissions: Create new Organizational Units (OUs). View all OU properties.
OUs - Full Control	Grants full permission to: Create new OUs. Perform all administrative operations on OUs.
OUs - Modify All Properties	Grants permission to view or modify all OU properties.
OUs - Read All Properties	Grants the following permissions: List OUs. View all OU properties.
Printers - Full Control	Grants full permission to: Create new printer queue objects. Perform all administrative operations on existing printer queues.
Printers - Modify All Properties	Grants permission to view or modify all printer queue properties.
Printers - Read All Properties	Grants the following permissions: List printer queue objects. View all printer queue properties.
Shared Folders - Full Control	Grants full permission to: Create new shared folder objects. Perform all administrative operations on existing shared folders.
Shared Folders - Modify All Attributes	Grants permissions to view or modify all shared folder properties.
Shared Folders - Read All Properties	Grants the following permissions: List shared folders. View all shared folder properties.
Users - Create User Accounts	Grants the following permissions: Create new user accounts. View all user account properties.
Users - Delete User Accounts	Grants the following permissions: Delete user accounts. View all user account properties.
Users - Full Control	Grants full permission to: Create new user accounts. Perform all administrative operations on existing user accounts.
Users - Help Desk	Grants the following permissions: Reset user passwords. Unlock user accounts. Assign or remove digital (X.509) certificates from user accounts. View all user account properties. TIP: One Identity recommends using this AT to delegate permissions required for the day-to-day operations of your helpdesk service.
Users - Modify All Properties	Grants permission to view or modify all user account properties.
Users - Modify Personal Data	Grants permission to manage the basic HR-related properties of user accounts.
Users - Modify Picture	Grants the following permissions: View or change the image, that is, the thumbnailPhoto attribute. View all user account properties.
Users - Move User Accounts	Grants the following permissions: Move user accounts. View all user account properties.
Users - Pager & Cell Phone Numbers	Grants the following permissions: View and modify the mobile phone and pager number information of the user accounts. View all user account properties.
Users - Perform Deprovision Tasks	Grants the following permissions: Deprovision user accounts and other user-related resources. View all user account properties. TIP: Use this AT to delegate user deprovisioning permissions to data administrators without also delegating user create and user delete permissions.
Users - Perform Undo Deprovision Tasks	Grants the following permissions: Restore user accounts. View all user account properties. TIP: Use this AT to delegate the permission of performing the Undo Deprovisioning command on user accounts only.
Users - Phone Number & Address	Grants the following permissions: Modify the address and telephone number properties of user accounts. View all user account properties.
Users - Read All Properties	Grants the following permissions: List user accounts. View all user account properties.
Users and Groups - Basic Management	Grants the following permissions: List groups and user accounts. Add or remove users and groups to or from groups. Reset user passwords. View or modify the login-related properties of user accounts.

セルフ・サービス・ツール: ナレッジベース; 通知および警告; 製品別サポート; ソフトウェアのダウンロード; 技術文書; ユーザーフォーラム; ビデオチュートリアル; RSSフィード

お問い合わせ: ライセンスアシスタンスの取得; Technical Support; すべて表示

製品を選択してください:

サービス向上のために、「Purpose of your Chat（チャットの目的）」を記入してください。

お客様の不具合に推奨されるソリューション

Active Roles 8.1.5 - Built-in Access Templates Reference Guide

Introduction

About built-in Active Roles Access Templates

Active Directory

Active Directory – General ATs