Solved

adding users and managing mailboxes without domain admin rights

Posted on 2004-09-01
7
228 Views
Last Modified: 2013-12-03
I have a need for our help desk to add/delete user accounts plus manage distribution lists in a windows 2000 environment. I don't want them to have full rights. What is the easiest way?
0
Comment
Question by:gaskew
  • 3
  • 3
7 Comments
 
LVL 25

Expert Comment

by:mikeleebrla
Comment Utility
this is kind of a catch 22 problem,,,, think about it,,, if you give them rights to add/delete accounts,, this means that they can also change anyone's password, INCLUDING any administrator account... so if you enable a user to add/delete accounts,, you are essentially giving them the administrator password as well,,, since they can change it at any time.   Of course you will know it has been changed,,, since you couldn't log on with the old password anymore.  
0
 
LVL 22

Accepted Solution

by:
kristinaw earned 250 total points
Comment Utility
gaskew,

actually, you can delegate the rights to manage ONLY the users you wish your help desk to have rights to. This is not a problem and is quite common. make a test OU and move the users into it you want your help desk to manage. Right click the OU and select delegate, then give your help desk users the create/delete/manage check box as well as the reset password box if you want them to be able to do that as well.

you can get very granular with the permissions for this kind of stuff. we do this in my environment and it works quite well. check the advanced security after you have delegated the rights to get an idea of what i mean.

kris.
0
 
LVL 25

Expert Comment

by:mikeleebrla
Comment Utility
this might work,,, but all of the distribution lists in question would have to be under that OU as well.
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 22

Expert Comment

by:kristinaw
Comment Utility
mike,

distribution lists aren't managed that way. they have a check box that gives the user permission to update group membership. If the box is checked and the appropriate user is filled in in the box, then the user can manage this group no matter where the object is located in AD. If you want help desk users to be able to manage these lists through the ADUC, then you can create a separate OU for them and delegate permissions on the group object under advanced security.

"this might work", it will work. i don't answer questions unless i'm sure of what i'm talking about.

kris.
0
 

Author Comment

by:gaskew
Comment Utility
Thanks for the quick response
0
 
LVL 25

Expert Comment

by:mikeleebrla
Comment Utility
kris,

why are you dogging on me???  FYI ...  ive answered some of your questions in the past

"this might work" what i meant by that is that it would work if it was set up correctly,,, but every environment is different so i never say this WILL work.
0
 
LVL 22

Expert Comment

by:kristinaw
Comment Utility
mike,

sorry, didn't mean to dog you. but, you can delegate rights to do things only on certain users. kind of one of the big pluses about AD. didn't mean to sound harsh.

have a good one,

Kris.
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
HOW TO: Connect to the VMware vSphere Hypervisor 6.5 (ESXi 6.5) using the vSphere (HTML5 Web) Host Client 6.5, and perform a simple configuration task of adding a new VMFS 6 datastore.
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now