User-support delegation
JFAD\GG-ServiceDesk received explicit rights on descendant users in the Service Desk OU for Reset Password, writing lockoutTime, and writing pwdLastSet.
Active Directory · least privilege · validated
Service Desk delegation with positive and negative controls.
A bounded personal-lab exercise delegated common Service Desk identity tasks to a non-admin role while preserving denial of broader account and privileged-group administration.
Validated scope
Delegation was narrow, explicit, and tested.
Group-membership delegation
The same group received explicit WriteProperty permission only on the member attribute of GG-RDP-Allowed.
Schema verification
An Active Directory schema lookup confirmed that the ACL object type used for the group delegation maps to the LDAP member attribute. The raw schema identifier is omitted from this public derivative.
Functional validation
Allowed tasks succeeded; broader tasks were denied.
Reset password
The non-admin validation account reset a separate test user's password.
Unlock account
The validation account unlocked a deliberately locked test user.
Force password change
The validation account successfully set the test user to change password at next logon.
Disable account denied
An attempt to disable the test account was rejected with insufficient access rights.
RDP group membership
The validation account successfully added and removed a test user from GG-RDP-Allowed.
Privileged group modification denied
An attempt to add the test user to GG-Lab-Admins was rejected with insufficient access rights.
Result and boundary
PASS — bounded least-privilege Service Desk delegation.
This evidence supports the existing home-lab Active Directory administration claim. It is personal nonproduction lab evidence only and does not claim enterprise directory ownership, production change authority, enterprise PAM, or organization-wide RBAC governance.