KB20161117-1 How to deny the Cayosoft Service Account permissions to an object

Published: November 17, 2016

Applies to: Cayosoft Administrator 2.x and later.

Summary: When Cayosoft Administrator is installed, the default suggested configuration is to run the service account with elevated privileges in Active Directory. This is to allow the service to perform tasks on behalf of a user using the solution. Some customers may want to exclude VIP or other sensitive accounts from the possibility of administration by Cayosoft Administrator. One option to accomplish this is to deny the Cayosoft Administration Service the permissions to act on such objects.

Denying Cayosoft Administrator native rights to modify an Active Directory object

1. Open the Active Directory Users and Computers native console
   (press the Windows+R keys to open the Run dialog, type dsa.msc then Enter)
2. Enable Advanced Features
   (Click menu item View > Advanced Features)
3. Find Domain Admins group (or any other object you want to hide from Cayosoft Administrator service account)
4. Open Group Properties and click the Security tab
5. Click Advanced button to open the Advanced Security Settings dialog box
6. Click Add to add new Permission entry
7. Click to Select security principal, then choose Cayosoft service account user
8. Set Type as Deny
9. Click Clear All in very bottom of the dialog, then select checkbox Full Access (or Write all properties if you want user to be able read group's properties)
10. Close all dialog boxes to save changes