Active Roles 7.2 - Access Templates Available out of the Box

Perform any administrative operation on any object in Active Directory.

This Access Template allows data owners to delegate control of Active Directory objects to data administrators who are responsible for carrying out all tasks required to manage the Active Directory contents.

List directory objects and view all properties of any object in Active Directory.

Apply this template to a container to allow viewing and restoring Active Directory objects that were deleted from that container.

Create new claim types; perform all administrative operations on existing claim types. Claim types determine the claims to be issued for an Active Directory security principal upon its authentication. Claim types are used to define permissions when authoring claim-based access rules.

View or change all claim type properties.

List claim types; view all claim type properties.

Create new computer accounts; view all properties of computer accounts.

Create new computer accounts; perform all administrative tasks on existing computer accounts.

View or change all properties of computer accounts.

Move computer accounts; view all properties of computer accounts.

List computer accounts. View all properties of computer accounts.

Reset computer accounts; view all properties of computer accounts.

Create new contacts, view all properties of contacts.

Create new contacts; perform all administrative operations on existing contacts.

View and modify all properties of contacts.

View or change the image of the contact (the thumbnailPhoto attribute of the contact object). View all properties of the contact object in the directory.

List contacts, view all properties of contacts.

List domain objects; view all properties of domain objects.

Create new group Managed Service Accounts; perform all administrative operations on existing group Managed Service Accounts.

View or change all properties of group Managed Service Accounts.

View or change the list of computers and computer groups allowed to use a given group Managed Service Account.

List group Managed Service Accounts; view all properties of group Managed Service Accounts.

View and modify lists of group members.

Create new groups, view all properties of groups.

Create new groups; perform all administrative operations on existing groups.

Configure rules-based management of group membership lists; view all properties of groups; list groups in containers; list containers.

View and modify all properties of groups.

View or change the image of the group (the thumbnailPhoto attribute of the group object). View all properties of the group object in the directory.

Deprovision groups; view all properties of groups. This template is intended to delegate the use of the Deprovision command on groups without requiring the delegation of the create/delete operation.

Restore (un-deprovision) groups; view all properties of groups. This template is intended to delegate the use of the Undo Deprovisioning command on groups.

List groups, view all properties of groups.

Create new Organizational Units; view all properties of Organizational Units.

Create new Organizational Units; perform all administrative operations on existing Organizational Units.

View and modify all properties of Organizational Units.

List Organizational Units; view all properties of Organizational Units.

Create new printer queue objects; perform all administrative operations on existing printer queue objects.

View and modify all properties of printer queue objects.

List printer queue objects; view all properties of printer queue objects.

Create new shared folder objects; perform all administrative operations on existing shared folder objects.

View and modify all properties of shared folder objects.

List shared folder objects; view all properties of shared folder objects.

Create new user accounts; view all properties of user accounts.

Delete user accounts; view all properties of user accounts.

Deprovision user accounts and other user-related resources; view all properties of user accounts. This template is intended to delegate the use of the Deprovision command on user accounts without requiring the delegation of the create/delete operation.

Restore (un-deprovision) user accounts; view all properties of user accounts. This template is intended to delegate the use of the Undo Deprovisioning command on user accounts.

Create new user accounts; perform all administrative operations on existing user accounts.

Reset user passwords, unlock user accounts, assign or remove digital (X.509) certificates from user accounts, and view all properties of user accounts.

Recommended for implementing Help Desk. Data owners can use this Access Template to delegate day-to-day operations to the Help Desk service.

View and modify all properties of user accounts.

Manage a basic set of HR-related properties in user accounts.

View or change the image of the user (the thumbnailPhoto attribute of the user account). View all properties of the user account in the directory.

Move user accounts; view all properties of user accounts.

View and modify mobile phone and pager numbers in user accounts, view all properties of user accounts.

Modify the address settings and telephone numbers in user accounts; view all properties of user accounts.

List user accounts; view all properties of user accounts.

Create computer objects; no other permissions are included.

Delete computer objects; no other permissions are included.

List computer objects; no other permissions are included.

View and modify properties that describe account restrictions for computer objects (User-Account-Restrictions property set); no other permissions are included.

Property set members: See “User-Account-Restrictions Property Set” at http://msdn.microsoft.com/en-us/library/ms684412.aspx

View and modify properties that constitute general information for computer objects:

• Computer name (pre-Windows 2000)
• DNS name
• Role
• Description
• The flags that control password, lockout, and disable/enable behavior (User-Account-Control attribute)

No other permissions are included.

View and modify what person is assigned to manage a computer (Managed-By attribute); no other permissions are included.

View and modify properties that describe personal information for computer objects (Personal-Information property set); no other permissions are included.

Property set members: See “Personal-Information Property Set” at http://msdn.microsoft.com/en-us/library/ms684394.aspx

View and modify properties that describe public information for computer objects (Public-Information property set); no other permissions are included.

Property set members: See “Public-Information Property Set” at http://msdn.microsoft.com/en-us/library/ms684396.aspx

Reset computer accounts; no other permissions are included.

Create contact objects; no other permissions are included.

Delete contact objects; no other permissions are included.

View a list of groups to which a contact object belongs; no other permissions are included.

View and modify properties that describe organizational information for contact objects:

• Job title
• Department
• Company
• Employee ID
• Manager
• Office location

No other permissions are included.

View and modify properties that describe personal information for contact objects (Personal-Information property set); no other permissions are included.

Property set members: See “Personal-Information Property Set” at http://msdn.microsoft.com/en-us/library/ms684394.aspx

View and modify properties that describe Web-related information for contact objects (Web-Information property set); no other permissions are included.

Property set members: See “Web-Information Property Set” at http://msdn.microsoft.com/en-us/library/ms684418.aspx

Change the PDC emulator role owner; no other permissions are included.

Apply Active Roles Access Templates and Policy Objects to a domain object; no other permissions are included.

Generate Group Policy Results data for the users/computers within a given domain; no other permissions are included.

Generate Group Policy Modeling data for the users/computers within a given domain; no other permissions are included.

List domain objects; no other permissions are included.

View and modify properties that constitute general information for domain objects:

• Domain name (pre-Windows 2000)
• Description

No other permissions are included.

View and modify what person is assigned to manage a domain (Managed-By attribute); no other permissions are included.

View and modify properties that permit control to a list of domain attributes (Domain-Other-Parameters property set); no other permissions are included.

Property set members: See “Domain-Other-Parameters Property Set” at http://msdn.microsoft.com/en-us/library/ms684338.aspx