Access Template to Deny Write permission of attribute/Flag 'Password Never Expire' is not taking place (effective).

Version: ARS 6.9 (without Patch4).

Question

Access Template to Deny Write permission of attribute/Flag 'Password Never Expire' is not taking place (effective). 
 
 Version: ARS 6.9 (without Patch4).

Michiel · Answer

Hi, 
 
Bit of a limited description so not sure if it's the same problem, but I've encountered a similar issue in the past; our Helpdesk has permission to "Undo Deprovision" and unfortunately this somehow also includes the "Password never expires" option to be changed. Raised a support case for this but turned out to be "By Design".. (?) 
 
The workaround I received was to: 
 
1) Only apply the "Undo Deprovision" access template to the OU holding the disabled accounts 
2) Add a Deny for "Write all Properties" to the Undo Deprovisioning acess template you're using 
 
By itself the above worked OK so issue resolved for me, but I still think it's weird that such a critical option could be exposed by an innocent AT to Undo Deprov. 
 
Hope this works for you!

Access Template to Deny Write permission to attribute/Flag 'Password Never Expire' is not taking place (effective) in ARS 6.9 (without Patch4).