ARS Read/Write Group Members

Question

I was trying to give a user read/write group member permissions directly in ADUC based on what permissions another user had. 
 I gave the user read member and write member permissions as those were the permissions that I saw on a working user, however, this did not work. 
 I then used ARS to apply the Read/Write Group Member template to the group object and it worked. 
 So my question is: What are the exact permissions this template applies and what attributes does it update? 
 
 Thank you, 
 JC

Eric Hibar Jr. · Answer

Permissions delegated to accounts natively in ADUC do not carry over to Active Roles. They are completely separate. I could grant Full Control permissions to a user in ADUC on the top level domain, ensuring it replicates down through every OU to every object, etc. But I still would have no rights whatsoever when I log in to Active Roles. The permissions that AR delegated can be seen by looking at the properties of the permission template applied to your user. Click on Permissions, and you will see the full list it contains. Additionally, AR does give you the ability to sync the permissions delegated within itself to native ADUC, but this practice is typically not recommended.

Endpoint Privilege Management

ARS Read/Write Group Members