Unable to enroll Privileged Accounts for Time based passcodes and Push Notifications


Version Affected:  IdP - All versions


A small group of Users report they are unable to enroll for Time based passcodes and Push Notifications.

Warning log says Exception:  LDAPProfileProvider.SetPropertyValues: Error received when saving data to user storage, exception: LDAPProfileProvider.SetPropertyValues: Got error when saving data to LDAP, exception: Access is denied.

Cause:  Privileged are protected in AD by AdminSDHolder


If you need to set granular permissions, the AD GUI does not handle this well. In the AD GUI, The permissions that apply to "This object and descendant" only shows you the wrong type of granular permissions, so if you correctly set this, you still cannot set the correct permission

Instead of using the GUI, open an Admin Command prompt and use dsacls to set the permissions. 


dsacls "cn=AdminSDHolder,cn=System,dc=wood,dc=sasp,dc=local" /G "wood\norights:RPWP;audio;"

The above command will grant access to the service account (called norights) It grans read permission and write permission to the audio attribute on the AdminSDHolder account. 

MS then periodically applies these permissions to your privileged accounts. 


SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.

0 out of 0 found this helpful



Please sign in to leave a comment.