Resolution
How to Prevent Assistant Admins From Setting the Trust computer for delegation Flag on a Computer Object
fact
Directory and Resource Administrator 6.x
fix
The Automation feature in DRA can be used to prevent Assistant Admins from checking the Trust computer for delegation (Trusted for Delegation) flag on a computer object. At this time, t here is no individual power in Directory and Resource Administrator that permits setting the flag.
fix
A pre-task trigger can be configured so that, when an Assistant Admin checks Trust computer for delegation on a computer object, DRA will display a customized error message and will prevent the change from taking place.
To configure the pre-task trigger, launch the MMC interface while logged on as an Assistant Admin with, at minimum, the Built-in Configuration role and perform the following steps:
- Expand the Policy and Automation management snap-in node.
- Select Automation Triggers.
- Click New.
- Click Browse and select ComputerSetInfo in the Associate to operation field.
- Select the Pre-Task radio button
- Click Next
- Select the ActiveViews and Assistant Admins over which the policy should be enforced.
- Click Next.
- Select the Script radio button.
- Enter the path to the script file (e.g: C:\Program Files\NetIQ\DRA\Scripts\TrustedForDelegation.vbs) in the DO file path.
- Click Next.
- Click Next.
- Specify a name for this trigger.
- Click Finish.
Once these steps have been performed, an Assistant Admin whose actions this policy enforces will receive an error message after selecting the Trust computer for Delegation flag and clicking Finish.
note
A sample script called TrustedForDelegation.vbs can be obtained from the DRA Knowledge Depot.
- DRA Knowledge Depot (requires username and password)
note
For more information on the Trust this computer for delegation flag, please refer to Microsoft Knowledge Base article Q283201