AD Pro Toolkit decides what each person can do with roles. You give a role to a user or a group, and anyone without a role can't use the app.
To manage access, go to Settings > Access control. Only Super admins can see this page.
Roles
| Role | What it can do |
|---|---|
| Super admin | Everything, including managing access, the license and the SSL certificate. |
| Admin | Reports, dashboards, every tool and settings. Not access, the license or the SSL certificate. |
| User admin | The user tools only. |
| Group admin | The group tools only. |
| Computer admin | The computer tools only. |
| User provisioning | The New user tool only. Can create accounts, but can't see or change existing ones. |
| Password reset | The password reset tool only. |
| Reports only | Reports and dashboards. No tools and no settings. |
| Reports only, no dashboards | Reports and scheduled reports. The dashboards stay hidden. |
The same list, with how many people have each role, is on the Roles tab of the Access control page.
Keep at least one Super admin. Only Super admins can manage access, so without one nobody can add or change roles.
Grant access
- Go to Settings > Access control and select Grant access.
- In Account or group, start typing a name and pick the user or group.
- Choose a Role.
- Optionally, limit the role to some OUs with the button under Limit to OUs. See Limit a role to OUs.
- Select Grant access.
Users or groups
Granting a role to a group is usually easier to manage. Everyone in the group gets the role, so you control access by adding people to the group in Active Directory, without coming back to AD Pro Toolkit. Nested groups count too.
A change to someone's group membership only takes effect after they sign out of Windows and back in.
Renamed accounts
Access is stored against the account's security ID (SID), not its name. Renaming a user or group in Active Directory doesn't change their access.
Limit a role to OUs
By default a role covers the whole domain. To limit it, choose one or more OUs under Limit to OUs when you grant it. The role then covers those OUs and every OU nested under them.
For example, a help desk in London could be a User admin limited to OU=London. They can manage
users in London, and nobody else.
A limit applies to reports as well as tools. A Reports only role limited to an OU sees only the objects in that OU.
More than one role
A person can have several entries, for example Reports only over the whole domain plus Password reset limited to one OU. They get everything those entries allow together.
This also happens when a person is in more than one group with access, or has a role of their own as well as one through a group.
Remove access
On Settings > Access control, select Remove next to the entry. To change someone's role or OUs, remove the entry and grant it again.
Things to know
- Roles decide what people can do in the app, not in Active Directory. AD Pro Toolkit makes every change with its own service account. A person with User admin can change users through the app even if their own account has no rights in Active Directory, and the service account must have permission for each change. See Permissions in the install guide.
- Every change is logged. The audit log under Settings > Logs records which person made each change.
- No role, no access. Someone with no role sees an Access denied page, with the account they are signed in as.