Solved

Windows 2003 AD delegation to add new users

Posted on 2007-04-04
7
335 Views
Last Modified: 2010-04-20
Our company has grown to a point we would like to use the ability to delegate someone to add users as well as computers. I ran the delegation wizard, and did a custom selection. When this user logs on, the only options in AD to add are users and computers. Whenever his account creates a new user, in the final step the message "The password for <username> can not be set due to insufficient privleges. Windows will attempt to disable this account." The account then shows up as disabled. Anybody have an idea of what I am missing?
0
Comment
Question by:Rodney Barnhardt
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
7 Comments
 
LVL 30

Expert Comment

by:LauraEHunterMVP
ID: 18853384
Off the top of my head, I'd say to run the Delegation Wizard again and grant that same group the ability to reset the user's password.

If that doesn't work, please clarify: what specifically did you delegate in the Delegation Wizard when you selected the custom task option?

Hope this helps.

Laura E. Hunter - Microsoft MVP: Windows Server - Networking
0
 
LVL 13

Expert Comment

by:strongline
ID: 18853387
why not use the pre-defined "create...manager user account"?

The thing you missed should be "reset password'
0
 
LVL 32

Author Comment

by:Rodney Barnhardt
ID: 18857188
I can not find a "reset password". Here is what I am doing:
1. Right clicking on the domain and chosing delegate control
2. Adding the user
3. Selecting "Create Custom Tasks"
4. Selecting "Only allow the following"
5. Selecting "User Objects" and "Computer Objects" and checking both the create and delete boxes on the bottom.
6. Checking all permissions except full control and allowing the wizard to complete.
I scrolled up and down all screens today, and did not see a "reset password" option.
0
Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

 
LVL 30

Accepted Solution

by:
LauraEHunterMVP earned 500 total points
ID: 18857206
"Create, Delete and Manage user accounts" and "Reset user passwords and force password change at next logon" are both pre-configured delegations in the wizard.  The following URL will walk you through the steps to delegate one or both of these tasks: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/ctrlwiz.mspx#ELD
0
 
LVL 13

Expert Comment

by:strongline
ID: 18858460
I guess you misunderstood something here. For user creation, you can use pre-defined tasks in delegation wizard; for computer joining into domain, you define "computer configuration\windows settings\security settings\local policies\user rights assignment\add workstation to domain" in default domain policy. By default everyone can add computer into domain.
0
 
LVL 32

Author Comment

by:Rodney Barnhardt
ID: 18858827
Thank you, that link almost has me there since the user can create the account now. The only other issue is since we run AutoCAD, the users need to be in the administrators group on the local machine. While this person can create the account now, there is still an "access denied" when trying to add the user to the administrators local computer group. I have it where they can join the computer to the domain, they can not modify the local administrators account. I looked through the options and tried a few on my test bed, but did not have any luck.
0
 
LVL 30

Expert Comment

by:LauraEHunterMVP
ID: 18858915
The user who is creating the account will need to be a local admin on the target workstation.  Best way to do this would be to add your HelpDesk group to the Administrators group using the Restricted Groups function in Group Policy.
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Issue: One Windows 2008 R2 64bit server on the network unable to connect to a buffalo Device (Linkstation) with firmware version 1.56. There are a total of four servers on the network this being one of them. Troubleshooting Steps: Connect via h…
A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question