Is it possible to delegate control of an OU that allows a group to install software and otherwise manage computers in that OU, but not to have any control over user accounts, passwords etc?
We have a native win2k domain and I'm trying to spread our load by allowing a user to install software on all the PC's in his department to save us the job. I've tried to test by moving a computer account into the appropriate OU then delegated full control of computer objects only to the appropriate user. It seems to have worked in that he can control that computer account, but he can't install software or do any other admin tasks when logged on to the PC itself.
I presume I've missed a permission somewhere but I'm not sure which one it is. Can anyone advise please?
I've been generous with the points as a quick answer is required. Thanks