Delegate control+taskpad

Hi there..

We are current running an domain with Active Directory (Win2k3) Our password policy is restricted so users only have 3 attempts to login with the right password or the account will be locked out.
However Domain Admins are atm. the only ppl how can unlock the account again - I Want to make that possible for my groups of "super users" to unlock some accounts in 1 OU (And no access to other OU- nor read account info)

My "super users" don't know anything about Win2k3 so i want to make it very easy for them.

Can it be done easyly or maby there are another (more easy?) solution
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dmitri FarafontovLinux Systems AdminCommented:
mmm something like this?

'// Name: unlockuser.vbs
'// Description: Script to unlock user accounts

Option Explicit

dim userid,UsrObj

'// Insert domain name on the following line
Const domain="DOMAIN"

'// Prompt for User ID to unlock
userid = inputbox("Enter the User ID:", "Unlock User")

Set UsrObj = GetObject("WinNT://" & domain & "/" & userid)
If UsrObj.IsAccountLocked = TRUE Then
UsrObj.IsAccountLocked = FALSE
End If

'// Display popup window on console indicating operation is complete
wscript.echo "Account " & domain & "\" & userid & " unlocked." & chr(13) & "Note: It may take as long as 15 minutes for this to take effect."

Than you can use Delegation Wizard on that OU, and set your helpers to "Change the user Accounts"
Dmitri FarafontovLinux Systems AdminCommented:
After all those operations you can place that script on their desktop or a network share. Whichever you feel more easier.
BalltownAuthor Commented:
thx for the script - I just add some lines and i works fine for me now.

However. i can't find Change the user Accounts" when i run the Delegation Wizzard. but i can find "Create, Delete and manege user accounts" but its way to much premissions for then.. Unlock is really the only think i want them to be able to.
Become a Certified Penetration Testing Engineer

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

BalltownAuthor Commented:
btw. we are running 2003 Domain. maby the "Change the user Accounts" is a part of windows 2000?
Dmitri FarafontovLinux Systems AdminCommented:
You will need to select Custom Delegation. From MS KB;en-us;q235531

If the administrator chooses to create a custom task to delegate, two dialog box are displayed in which the administrator can customize the delegated task:1. Level of delegation. The administrator can choose to delegate to the entire folder, or to specific objects within the folder.  
2. In the next dialog box, the administrator dictates the permissions the specified users will be able to exercise.  

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Dmitri FarafontovLinux Systems AdminCommented:

I was wondering as regards to grade "B" Do you need additional clarification?
BalltownAuthor Commented:
Well after have read and try'd MS KB235531 And KB279752 i ant working for me.. I have been google alot but no usefull infomation. i think i will try with an taskpad and se if it will work.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.