1 Overview
SoftwareCentral has a module for controlling active directory; this module provides the functionality to delegate tasks to manage the active directory based on SoftwareCentral’s security roles, so they have limited access.
This module also provides extra function for resetting user password and make users temporary local administrators on a device.
The module is part of the license of SoftwareCentral. If the AD menu or the pages below are missing, the module has not been enabled.
2 What the module contains
The pages are found under the AD menu.
| Page | What you use it for |
|---|---|
| AD Users | Create, edit and delete Active Directory users, including their group memberships, and enable, disable and unlock accounts. |
| AD Computers | Create, edit and delete computer accounts, set the manager and the group memberships, and see BitLocker recovery passwords. |
| AD Groups | Create, edit and delete groups and manage their members. |
| Reset Password | Reset the password of a user, and unlock or enable the account. |
| Reset Password self-service | Let users reset their own password from their mail. See also Reset Password Configuration. |
| Local Group Administration | Make users temporary or permanent members of a local group, such as Administrators, on a computer. See also Local Group Overview and Local Group Reports. |
| Azure AD Users | The same kind of user management for Entra ID (Azure AD) users. |
| Azure AD Groups | Manage Entra ID (Azure AD) groups and their members. |
3 Who can do what
Everything in the module is controlled by the security role of the person who is signed in.
- A role only sees the domains and organizational units that have been delegated to it, and the users, computers and groups inside them.
- Each function has its own permission on the role: for example view, create, edit and delete for users, computers and groups, enable or disable an account, edit the group memberships of a user or a computer, show the local administrator password of a computer, and reset passwords, unlock and enable accounts.
- A role that may only view a user or a computer sees the page in read-only mode.
- For local groups there are separate permissions to make a membership permanent and to remove a user from a local group.
The permissions are given to a role in the same way as any other menu button. See Security Roles.
SoftwareCentral does the changes in Active Directory with its own service account, on behalf of the signed-in user. The account therefore needs the rights described in Active Directory Module Delegation of privilege.
4 Settings
| Setting | What it does |
|---|---|
| Organizational Unit with AD-Module templates | Settings › Domain › Active Directory. When a new AD user or computer is created, only the objects in this organizational unit can be used as templates. |
| Local group settings | Settings › Domain › Active Directory. Options for the local group function: ignore the ping check, use the fully qualified computer name, use the ObjectSid, send a mail notification, the maximum time a user can be a member, and how many days SoftwareCentral tries to remove a user. See Local Group Administration and Pre-Windows 2000 domain names. |
| Use double wildcard search | Settings › Domain › Active Directory. Lets you search for part of a group name, which slows the search down. |
| Reset Password mail settings | The inbox that SoftwareCentral monitors for reset requests. See Reset Password Configuration. |
5 Best practice
- Give each role only the permissions it needs, and delegate only the organizational units it has to manage, so a service desk role cannot touch other parts of the directory.
- Give the SoftwareCentral service account only the delegated rights for the object types you use, and nothing more. The delegation guides list them per object type.
- Give read-only roles the view permission only.
- Keep the template organizational unit small and use it for approved examples of a standard user or computer.
- Use HTTPS for SoftwareCentral, because passwords are typed into the module.