How to Enable Computer Object from Active Roles

Are you simply needing to enable the computer account or is there more to your "enabling" process?

Do you want that to happen automatically after the move or do you intend for the help desk to perform the task manually through AR web UI?

We just want the task to be manually performed by Helpdesk . 

You need to create an access template to grant the Help Desk team (by way of a group membership) modify access to the disabled state of computers.  This template would be linked to the OU(s) where your computer accounts reside.

support.oneidentity.com/.../32

Here's some screen caps of what the setup of the inside of that access template would look like:

I did enable this in Access Template but do not see the option to disable or enable when the Computer object is selected. Let me verify if OU has inheritance block which may be preventing this permission from being applicable.

I did enable this in Access Template but do not see the option to disable or enable when the Computer object is selected. Let me verify if OU has inheritance block which may be preventing this permission from being applicable.

I have made the change as suggested and assigned this permission on specific OU but still the user is not able to Disable / enable laptop present in that OU. It will be of great help if you can please provide screenshot of how it will appear from Web UI when this permission is assigned to user over computer object.

Hi rmahabaleshwar 

If you're using the Helpdesk site, I suspect that "Enable" or "Disable" options are not part of that template, as per the screenshot below:

If you were to compare that against the template used for the Administration website, as per the screenshot below, there are a lot more commands available on this site, using that template

You have a couple of options open to you,

1. Let the helpdesk use the ARWebAdmin page (if there permissions are correct they should not be able to do anything you don't want them to do, if they can, you're permissions are incorrect and that would need to be resolve, as just giving them the Helpdesk page is not a solution as they still hold the permissions, and therefore could use PowerShell, ARS ADSI provider or potentially the console to do those changes that way instead).
2. Add new commands for the ARWebHelpdesk site, for Enable and Disable accounts, you would in theory create the commands using the equivalent commands in the ARWebAdmin page for reference (IE manually create the commands based off the admin page).
3. Add a new command which sets a VA, then use a workflow to disable or enable the computer.

The Disable Coammnd from the Admin site looks like this:

Hope this helps

Hi Stu.Pollock 

Thank You very much... I am now able to get the Disable / Enable Option for Computer Account . The visibility criteria was set on ARwebAdmin which prevented it from being available to all. 

glad you got it working rmahabaleshwar