SoftwareCentral · AD delegation

Delegation for Group objects

Give the SoftwareCentral account the rights to create and delete groups in Active Directory, and to add and remove their members. Two delegations are needed, and both go to the same account.

Create and delete groups Add and remove members Full Control

1 What the delegation is for

SoftwareCentral creates and deletes groups in Active Directory, and it adds computers and users to groups and removes them again. Creating and deleting a group needs the first delegation in the steps. Changing the members needs the second.

What SoftwareCentral doesWhen it happens
Create a groupIn the AD group window, and when SoftwareCentral creates the AD group for an application group.
Change the properties of a groupIn the AD group window.
Delete a groupOn the AD group page. The group object is removed from Active Directory.
Add or remove membersFor example when an approved order puts the user in an AD group, and in other jobs that keep group membership up to date.

2 Which account to delegate to

Give the delegation to the account that SoftwareCentral uses to sign in to Active Directory, not to a person's own account.

SituationAccount to delegate to
The server's own domain, and any other domain where the server's domain and that domain are both TrustedThe application pool account, set under Settings › General Settings › Server Configuration in Application Pool Username.
Any other domain where the server's domain or that domain is not TrustedThe Service Account in that domain's row under Settings › Domain › Domains.

In the steps below, the SoftwareCentral service account means this account, written as for example CONTOSO\svc-swc.

3 Delegate on group objects

Do these steps in Active Directory Users and Computers, once for each domain. The values in the pictures are examples, and the domain and account names are masked.

Part 1: create and delete groups

StepWhat you doScreen
1 Open Active Directory Users and Computers.  
2 Right-click the domain, then select Delegate Control….
Active Directory Users and Computers: the right-click menu of the domain, with Delegate Control in the list
Right-click the domain, then Delegate Control….
3 Click Next.
Delegation of Control Wizard, welcome page, with the Next button
The welcome page. Click Next.
4 Click Add.
Delegation of Control Wizard, Users or Groups page, with an empty list and the Add button
The Users or Groups page. Click Add.
5 Enter the SoftwareCentral service account in Enter the object names to select, then click Check Names.
Select Users, Computers, or Groups dialog: From this location shows the domain, and the service account is entered in Enter the object names to select
Enter the account, then click Check Names.
6 Click OK.
Select Users, Computers, or Groups dialog with the account resolved to its full name
The account is resolved. Click OK.
7 Click Next.
Delegation of Control Wizard, Users or Groups page, with the service account in the Selected users and groups list
The account is in Selected users and groups. Click Next.
8 Select Create a custom task to delegate, then click Next.
Tasks to Delegate page with Create a custom task to delegate selected
Select Create a custom task to delegate.
9 Select Only the following objects in the folder. Tick Group objects, then tick Create selected objects in this folder and Delete selected objects in this folder. Click Next.
Active Directory Object Type page: Only the following objects in the folder is selected, Group objects is ticked, and both Create and Delete selected objects are ticked
Tick Group objects and both options at the bottom.
10 Select Full Control, then click Next.
Permissions page with Full Control at the top of the list
Select Full Control.
11 Click Finish.
Completing the Delegation of Control Wizard: the summary shows the domain, the service account and the permissions
The summary. Click Finish.

Part 2: add and remove members

StepWhat you doScreen
12 Right-click the domain once more, then select Delegate Control….
Active Directory Users and Computers: the right-click menu of the domain, with Delegate Control in the list
Right-click the domain again, then Delegate Control….
13 Click Next.
Delegation of Control Wizard, welcome page, with the Next button
The welcome page. Click Next.
14 Click Add.
Delegation of Control Wizard, Users or Groups page, with an empty list and the Add button
The Users or Groups page. Click Add.
15 Enter the SoftwareCentral service account in Enter the object names to select, then click Check Names.
Select Users, Computers, or Groups dialog: From this location shows the domain, and the service account is entered in Enter the object names to select
Enter the account, then click Check Names.
16 Click OK.
Select Users, Computers, or Groups dialog with the account resolved to its full name
The account is resolved. Click OK.
17 Click Next.
Delegation of Control Wizard, Users or Groups page, with the service account in the Selected users and groups list
The account is in Selected users and groups. Click Next.
18 Select Delegate the following common tasks, tick Modify the membership of a group, then click Next.
Tasks to Delegate page: Delegate the following common tasks is selected, with Modify the membership of a group ticked
Tick Modify the membership of a group.
19 Click Finish.
Completing the Delegation of Control Wizard: the summary shows the domain, the service account and the tasks
The summary, with the tasks. Click Finish.

4 Best practice

  • Give both parts to the same account. Part 1 lets SoftwareCentral create and delete groups. Part 2 lets it add and remove members. Without part 2, the membership changes fail, and without part 1, groups cannot be created or deleted.
  • Keep privileged groups outside the scope. The membership right applies to any group in the delegated OUs, so keep administrator and other privileged groups in OUs that are not delegated.
  • Include the OU for the groups SoftwareCentral creates. The group window asks for an OU, and the group is created there. Delegate on that OU as well if you do not delegate on the whole domain.
  • Remember that delete removes the group object. Deleting a group from SoftwareCentral removes the group from Active Directory, not only from SoftwareCentral. Check that nothing else uses the group first.

5 Troubleshooting

The messages are written to the Log. Find the entries for Active Directory there.

SymptomCauseWhat to do
Failed to create group '…' in OU '…'. The account cannot create group objects in that OU. Add Create selected objects in this folder for Group objects on that OU, as in step 9.
Failed to create group '…' in OU '…', group name already exist in domain. A group with that name already exists in the domain. Choose another name, or use the existing group.
Failed to delete group by distinguished name '…'. The account cannot delete the group object. Add Delete selected objects in this folder for Group objects on the OU of the group, as in step 9.
Failed to add resource '…' to AD-Group '…' on domain '…'., or Failed to add N resources to AD-Group … The account has no right to change the members of that group, or the group is outside the delegated OUs. Check part 2: Modify the membership of a group must be delegated to the account on the OU of the group.
Failed to remove resource '…' from AD-Group '…' on domain '…'., or Failed to remove N resources from AD-Group … The same as above, for removing members. Check part 2 as above.