# Can we change or update roles of the users in Active Directory by a script in vision?

**URL:** <https://forum.inductiveautomation.com/t/can-we-change-or-update-roles-of-the-users-in-active-directory-by-a-script-in-vision/81054>\
**Category:** Ignition\
**Tags:** vision\
**Created:** [October 26, 2023, 9:56pm UTC](https://forum.inductiveautomation.com/t/can-we-change-or-update-roles-of-the-users-in-active-directory-by-a-script-in-vision/81054 "2023-10-26T21:56:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pranjali.ramtekkar](https://avatars.discourse-cdn.com/v4/letter/p/6f9a4e/32.png) [@pranjali.ramtekkar](https://forum.inductiveautomation.com/u/pranjali.ramtekkar)\
**Post date:** [October 26, 2023, 9:56pm UTC](https://forum.inductiveautomation.com/t/can-we-change-or-update-roles-of-the-users-in-active-directory-by-a-script-in-vision/81054/1 "2023-10-26T21:56:38Z")

</div>

I am trying to write a script which check if the user has access to modify screens on a application. if not I want to update user role ( in my example from operator to administrator) . However , \*\*system.security.getUserRoles(username, password, [authProfile], [timeout]) requires the password . Can you let me know if there is any function in vision I can use to change the user permission?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [October 26, 2023, 10:00pm UTC](https://forum.inductiveautomation.com/t/can-we-change-or-update-roles-of-the-users-in-active-directory-by-a-script-in-vision/81054/2 "2023-10-26T22:00:55Z")

</div>

Ignition's access to AD is read only.

---

<div class="post-metadata">

**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\
**Post date:** [October 26, 2023, 10:12pm UTC](https://forum.inductiveautomation.com/t/can-we-change-or-update-roles-of-the-users-in-active-directory-by-a-script-in-vision/81054/3 "2023-10-26T22:12:45Z")

</div>

If you use AD Internal Hybrid you can use AD for authentication and set the roles in Ignition.

> [@pranjali.ramtekkar](#):
>
> I am trying to write a script which check if the user has access to modify screens on a application. if not I want to update user role (in my example from operator to administrator) .

So every unauthorised user becomes an administrator? That isn't going to end well. I think you need to redefine your requirements.