AD user modification interface / limited mmc console

Posted on 2008-11-11
Last Modified: 2012-05-05
Hello Experts,
I have to give a interface to a user not part of it or technical group just to perform a attribute change, how can i do this ? what is the tools available to give to users desktop?
Administrative Tools\Active Directory Users and Computers - this is too much for the user, i would like to limit the AD .i just need to give the users to access few users under one group, nothing else , may be a single OU visible to that user will be fine but the user need to view all users under one particular group,

any help?
Question by:Thushya
    LVL 23

    Expert Comment

    by:Malli Boppe
    I don't think you can have a limited MMC. You can restrict the user to change any thing on that one OU  or you can use third party web tools in the market.
    LVL 5

    Accepted Solution

    First of all you need to restrict AD this can be done with "delegation of control".
     If you need to set permissions manually selct the advanced features in "active directory users and computers" from the view menu. With advanced features every OU has a security tab.
    To give users not the whole view of AD you can make a customized mmc:
    • Open mmc (start - run - mmc.exe)
    • File - "add/remove snap-in" - add
    • select "active directory users and computers"
    • Add - close - ok
    (If you just open dsa.msc it won't work)
    • now right click the OU that you need
    • Click "new window from here"
    • minimize the active window within the mmc
    • close the full "active directory users and computers" snap-in
    • maximize your OU snap-in

    Now you can create a taskpad view to add tasks to your snap-in:
    • right click the OU
    • click "new taskpad view"
    • follow the wizard to create tasks

    And finally you can limit the console:
    • File - options
    • select one of the user modes

    Now you can save your console as a *.msc file and distribute it to the users that need it.
    NOTE: It's very important that you install the adminpak on the client computer, otherwise the clients cannot open it won't work.
    Good luck!

    Author Comment

    Minvis -:)
    this is what exactly i am looking for , i have given the limited rights to attributes through delegating but not convince giving the full AD tree, now i can do the trick - thank you so much.

    Author Closing Comment


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Should I Do With This Threat Intelligence?

    Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

    Starting in Windows Server 2008, Microsoft introduced the Group Policy Central Store. This automatically replicating location allows IT administrators to have the latest and greatest Group Policy (GP) configuration settings available. Let’s expl…
    Installing a printer using group policy preferences is not that hard let’s take a look at it. First lets open up your group policy console and edit the policy you want to add it to. I recommend creating a new policy for each printer makes it a l…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
    This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now