Deny User Creation

Question

Hi I want to prevent helpdesk users creating new users in a particular container...I have created a template with Create User Objects denied (amongst other permissions denied as that did not seem to work) delegated it to a test user on the container in question but still able to create users, i must be missing something really obvious but can't work out what it is, can anyone help please? Thanks, Andy

JohnnyQuest · Accepted Answer

Verify that your users don't have "ARS Admin" privileges as these ignore your delegations and simply grant users all rights that your service or override account has. 
 
In version 6.x, you can check this by connecting as one of your delegated users in the ARS MMC and right clicking "About" in the topmost ActiveRoles node. In the popup dialog, you will see an entry about "ActiveRoles Admin" and it will say either "Yes" or "No". 
 
In general, "denies" are a bad practice and can lead to headaches down the road. 
 
ARS has a "positive access model" where users start with no access (not even read) so you should really take a close look at how you are granting access in the first place. For example, do not apply access templates to the root of your domain but rather, only in the containers where you wish them to apply. 
 
If you want some users to have user create rights in an OU and some not, create yourself two different role groups for these users and only place the users you want to have create privileges in the group that grants these privileges. Then grant just that role group the create privileges.

andyslk67 · Answer

Cheers JohnnyQuest, yes the helpdesk users are ActiveRoles Server Administrators....ooops thanks for taking the time to reply!