Issue description   

Users may encounter the error message "Permission denied. Please contact your administrator" when attempting to:

1. Log in to the ADSelfService Plus portal for enrollment.
   
2. Perform a password reset or account unlock.
   

This error prevents end users from utilizing essential self-service functionalities.

Possible causes   

• The user's OU or group is not included in any ADSelfService Plus policy.

• The user belongs to an ADSelfService Plus policy in which password reset or account unlock is disabled.

Prerequisite   

• Administrative access to the ADSelfService Plus console.

Resolution  

Step 1: Verify the ADSelfService Plus policy configuration  

1. Log in to the ADSelfService Plus administrator console.

2. Navigate to Configuration > Self-Service > Policy Configuration.

3. Identify the policy that applies to the affected user in the Available Policies section.

4. Click the Edit (pencil) icon under the Actions column.

Step 2: Modify the policy  

Case 1: The user’s OU/group is not included  

• Under Select OUs/Groups, select the OU/Group that includes the affected user.

• Click Save to apply the changes.

Case 2: Password reset or account unlock is disabled  

• Ensure the Reset Password or Unlock Account option is enabled for the respective policy.

• Click Save to update the policy.

Validation and confirmation 

1. Instruct the end user to log out and log back in to ADSelfService Plus.
2. Ask the end user to attempt a password reset or account unlock.
   

Troubleshooting tips   

1. If the error persists, verify that the user’s account is not locked or disabled in AD.
2. Check for any conflicting policies that might override the current configuration.
   

Best practices   

1. Periodically check ADSelfService Plus policies to ensure they are applied to the correct OUs and groups.
   
2. Before deploying policies to all users, test them on a small group to avoid unintended issues.
   

How to reach support