No announcement yet.

Error for Delegated Control users

  • Filter
  • Time
  • Show
Clear All
new posts

  • Error for Delegated Control users

    I've got a situation where I've delegated controls to the Helpdesk guys, but they are getting errors when trying to perform functions through Hyena.
    They've been given essentially all access in the delegated controls Wizard. But if they even right click and go to properties, it gives them 'Unable to access RAS information for user xxxx' but then they click OK and it opens up the properties.

    To create an account, they get that same error, plus "Unable to save Active Directory Data. Access is denied. Extended error --- LDAP Provider : 00002098: SecError: DSID-03150BB9 prob 4003, (INSUFF_ACCESS_RIGHTS), data 0"

    Eventually they are able to get through the process, even with the errors. However, if the same users just pull up Active Directory Users and Computers, they can do anything they want to the profiles that they were given permissions to without any errors at all. The errors only pop up when using Hyena.

    I've dug and dug, and haven't found a solution for this. There were mentions of this same error, but in most cases they were tied to Exchange. Currently we don't use Exchange so this wouldn't apply to us. We are on a 2008 R2 domain.
    Any help would be greatly appreciated because I just can't get around the errors

  • #2
    Re: Error for Delegated Control users

    For the permissions issue, this is probably caused by not having permissions to write to useraccountcontrol as well as the delegated rights.

    Do they need to access RAS information? If so, what OS do they have Hyena installed on? What version of AD are you accessing?


    • #3
      Re: Error for Delegated Control users

      Hyena is installed on either a local Windows 7 Ent 64bit box, or can be accessed through Citrix on a 2008 R2 64bit box.

      I have given them pretty much full rights through Delegated Controls wizard.
      They shouldn't need access to RAS info as we don't typically use that function (a few one-offs).

      version of AD? We're running 2008 R2 domain level if that's what you mean.

      If they have 'full' rights, would that not also cover the useraccountcontrol?


      • #4
        Re: Error for Delegated Control users

        No, I believe you set useraccountcontrol seperately. If they don't need RAS you can disable that option under Tools->Settings->User.


        • #5
          Re: Error for Delegated Control users

          Looks like it was the RAS setting for the errors the helpdesk guys were getting. Thanks for your help