HomeActive Directory Service Desk Delegation Validation

Technical source document

Active Directory Service Desk Delegation Validation

Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.

Original GitHub document All documentation

Active Directory Service Desk Delegation Validation

Captured: 2026-09-05

Classification: sanitized public personal-lab evidence

Preservation and derivative relationship

This public file is a sanitized presentation derivative. The first captured evidence is retained byte-for-byte in source-original/. The derivative preserves the validated tasks, results, scope, and limitations while omitting unnecessary raw directory identifiers.

Purpose

This evidence records a least-privilege Active Directory delegation exercise in the personal nonproduction ad.jeremyfontenot.online lab. The goal was to allow a Service Desk security group to perform bounded user-support and group-membership tasks without Domain Admin rights.

Delegated principal

  • Security group: JFAD\GG-ServiceDesk
  • Validation account: JFAD\sd.tech
  • Scope: OU=Service Desk,OU=Users,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online

Validated user-support rights

The Service Desk OU ACL was configured with explicit, non-inherited rights that apply to descendant user objects:

  • Reset Password extended right
  • Write lockoutTime for account unlock
  • Write pwdLastSet for force-password-change-at-next-logon

The validation account successfully:

  • reset the password of a separate test user;
  • unlocked a deliberately locked test user; and
  • set the test user to change password at next logon.

A negative-control test confirmed that the same account could not disable the test account and received Insufficient access rights to perform the operation.

Validated group-membership delegation

JFAD\GG-ServiceDesk was granted explicit WriteProperty permission on only the member attribute of GG-RDP-Allowed.

An Active Directory schema lookup confirmed that the ACL object type used for this delegation maps to the LDAP member attribute. The raw schema identifier is intentionally omitted from the public derivative because the attribute-name mapping is sufficient to support the bounded claim.

The validation account successfully added and removed a test user from GG-RDP-Allowed.

A negative-control test confirmed it could not add the same test user to GG-Lab-Admins and received Insufficient access rights to perform the operation.

Result

PASS — bounded least-privilege Service Desk delegation was configured and functionally validated.

The evidence supports a personal-lab claim of scoped Active Directory delegation for common Service Desk operations. It does not claim enterprise directory ownership, production change authority, privileged-access-management deployment, or organization-wide RBAC governance.

Evidence files