Many thanks for this solution, it worked perfect

2011-10-25T18:49:03.390-07:00

Dear Jeff,
i have checked the DSSEC.DAT file i...

2009-05-23T05:10:33.021-07:00

Dear Jeff,
i have checked the DSSEC.DAT file in windows 2008, under [USER]you will found the below list:
[user]
aCSPolicyName=7
adminCount=7
allowedAttributes=7
allowedAttributesEffective=7
allowedChildClasses=7
allowedChildClassesEffective=7
badPasswordTime=7
badPwdCount=7
bridgeheadServerListBL=7
c=7
canonicalName=7
co=7
codePage=7
controlAccessRights=7
countryCode=7
createTimeStamp=7
dBCSPwd=7
defaultClassStore=7
destinationIndicator=7
displayNamePrintable=7
distinguishedName=7
dSASignature=7
dSCorePropagationData=7
dynamicLDAPServer=7
extensionName=7
flags=7
fromEntry=7
frsComputerReferenceBL=7
fRSMemberReferenceBL=7
fSMORoleOwner=7
garbageCollPeriod=7
generationQualifier=7
groupPriority=7
groupsToIgnore=7
instanceType=7
isCriticalSystemObject=7
isDeleted=7
isPrivilegeHolder=7
l=7
lastKnownParent=7
lastLogoff=7
lastLogon=7
legacyExchangeDN=7
lmPwdHistory=7
localeID=7
logonCount=7
mail=7
managedObjects=7
masteredBy=7
maxStorage=7
mhsORAddress=7
modifyTimeStamp=7
mS-DS-ConsistencyChildCount=7
mS-DS-ConsistencyGuid=7
mSMQDigests=7
mSMQDigestsMig=7
mSMQSignCertificates=7
mSMQSignCertificatesMig=7
msNPAllowDialin=7
msNPCallingStationID=7
msRADIUSCallbackNumber=7
msRADIUSFramedIPAddress=7
msRADIUSFramedRoute=7
msRADIUSServiceType=7
netbootSCPBL=7
networkAddress=7
nonSecurityMemberBL=7
ntPwdHistory=7
nTSecurityDescriptor=7
o=7
objectCategory=7
objectClass=7
objectGUID=7
objectVersion=7
operatorCount=7
otherWellKnownObjects=7
ou=7
partialAttributeDeletionList=7
partialAttributeSet=7
physicalDeliveryOfficeName=7
possibleInferiors=7
preferredDeliveryMethod=7
preferredOU=7
primaryGroupID=7
primaryInternationalISDNNumber=7
primaryTelexNumber=7
proxiedObjectName=7
proxyAddresses=7
queryPolicyBL=7
registeredAddress=7
replPropertyMetaData=7
replUpToDateVector=7
repsFrom=7
repsTo=7
revision=7
rid=7
sAMAccountType=7
sDRightsEffective=7
securityIdentifier=7
seeAlso=7
serverReferenceBL=7
servicePrincipalName=7
showInAddressBook=7
showInAdvancedViewOnly=7
sIDHistory=7
siteObjectBL=7
sn=7
st=7
subRefs=7
subSchemaSubEntry=7
supplementalCredentials=7
systemFlags=7
teletexTerminalIdentifier=7
telexNumber=7
terminalServer=7
textEncodedORAddress=7
tokenGroups=7
tokenGroupsNoGCAcceptable=7
unicodePwd=7
url=7
userPassword=7
userSMIMECertificate=7
uSNChanged=7
uSNCreated=7
uSNDSALastObjRemoved=7
USNIntersite=7
uSNLastObjRem=7
uSNSource=7
wbemPath=7
wellKnownObjects=7
whenChanged=7
whenCreated=7
x121Address=7

and i can configure the Delegation to unlock users , what i get in windows 2008 if the attribute is not listed, it will = 0 , so no need to add it, if you are running windows 2000 you need to add it.

Comments on The EXPTA {blog}: How to Delegate the Right to Unlock User Accounts

Many thanks for this solution, it worked perfect

Dear Jeff, i have checked the DSSEC.DAT file i...

Dear Jeff,
i have checked the DSSEC.DAT file i...