How do I create an ActiveView such that Assistant Admins with the 'Built-in AccountView' role are able to view the group membership of all users?
Directory and Resource Administrator 6.60
The following is a step by step process for creating an ActiveView for allowing Assistant Admins with the' Built-in AccountView' role to be able to view the user accounts group membership.
Launch the MMC interface while logged on as an Assistant Admin with, at minimum, Built-in Security Role.
- Expand ActiveView management.
- Highlight ActiveViews and select the ActiveView in question.
- In the Add objects dialog box, select Include Groups and click Next.
- Highlight In Specific Domain, select the domain and click Next.
- Highlight All Groups and click Next.
- In the Add any exceptions screen leave all options unchecked and click Next.
- Click Finish.
The above is an example of how to configure an ActiveView so that the Assistant Admin with the 'Built-in AccountView' role are also able to view group membership of the users. Since the Assistant Admins have not been delegated the ability to modify group membership they will not be able to add or remove members from groups.