JSI Tip 3914. How can I delegate the right to unlock locked user accounts, in a batch file?

The Dsacls.exe tool can manage access control lists (ACLs) for directory services.

To delegate the right to unlock user accounts in the ouname OrganizationUnit to the members of the DomainGroupName security group:

dsacls "ou=ouname,dc=domain,dc=com" /i:s /g "DomainGroupName":rpwp;lockouttime;user

Where:

"ou=ouname,dc=domain,dc=com"                 - The OU to which you want to delegate authority./i:s                                         - Permissions are inherited onto child objects only. /g "DomainGroupName":rpwp;lockouttime;user  - Grant Read and Write Permission,                                               grant permission to the lockoutTime attribute,                                               grant the permission to user objects only,                                               to the "DomainGroupName".

To delegate the authority to members of the Help Desk group over user accounts in the Sales Organization Unit in the prod.jsiinc.com domain (down-level domain name = prod):

dsacls "ou=sales,dc=prod,dc=jsiinc,dc=com" /i:s /g "prodhelp desk":rpwp;lockouttime;user