Printable View
I want to stop Account Operators from being able to enable user accounts residing within a particular OU. I have tried to add the deny permission for the "Write userAccountControl" property for user objects for the Account Operators group. The effective permissions continue to show full control, however. Can anyone tell me what am I missing? Thanks.
I think that you will need to remove them from that security group, check the below article:
http://www.microsoft.com/smallbusine...in_groups.mspx
It could be that your account operators need some further introduction on how to handle your company policies or else you can remove them from the account operators group. You can also try to create a new security group and then add your users and delegate control on a specific OU with only the needed permissions for them instead of using the account operators group.
You can try to create a new OU and use the deny permission on Account Operators and check if that works or not.