Solved

Logon to XP workstations but can reset passwords on an 2003 domain

Posted on 2009-04-02
7
215 Views
Last Modified: 2012-05-06
We have teachers that logon to various workstations in multiple rooms but they need to have an interface each time that will enable them to reset passwords in AD. We do not want them to have admin rights or logon to the server not even using remote. Any ideas how we can make this happen so that it starts when they logon?
0
Comment
Question by:AndyinJapan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 8

Expert Comment

by:Share-IT
ID: 24049417
install the admin pack (adminpak.msi) on the client machines. Give them a short cut that points to dsa.msc.
Then give them the account operators rights on the AD.
0
 
LVL 70

Expert Comment

by:KCTS
ID: 24049431
You can delegate control to them to allow them to change passwords and provide them with a custom taskpad
http://www.petri.co.il/create_taskpads_for_ad_operations.htm
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 24049449

It depends how complicated you want  to get, and how simple it has to be for the teachers.

But you could potentially install the AdminPak on that machine which would give them AD Users and Computers. Creating a group and granting that group the "Reset Password" right on all user objects (or the ones you want them to be able to change).

Chris
0
Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 
LVL 71

Expert Comment

by:Chris Dent
ID: 24049458

I would avoid Account Operators, they can create / delete accounts as well which seems more than you need?

Chris
0
 
LVL 38

Expert Comment

by:ChiefIT
ID: 24057042
If they have to reset their password each time they logon to a different location, it sounds like they may have passwords changed while logged on from a location or two. Or maybe they have managed passwords on some of these computers.

Really, there shouldn't be much of a need to reset passwords to that extent.
0
 

Author Comment

by:AndyinJapan
ID: 24143862
Hi all,
I can install the admin pack but the issue is with that solution is there are too many PC's to install it to. I had heard of someone setting up the admin pack or at lease something like that when that certain user logon they also got the admin pack installed. I'm not sure if this worked or not...

Many thanks for all your help...
Andy
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 24145711

It's an MSI file so you should be able to deploy it easily enough using Group Policy if necessary. There are instructions for doing that here:

http://support.microsoft.com/kb/816102

The only change I'd make is that I recommend using this to manage group policy rather than trying to do it through AD Users and Computers:

http://www.microsoft.com/downloads/details.aspx?FamilyID=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en

Chris
0

Featured Post

Comparison of Amazon Drive, Google Drive, OneDrive

What is Best for Backup: Amazon Drive, Google Drive or MS OneDrive? In this free whitepaper we look at their performance, pricing, and platform availability to help you decide which cloud drive is right for your situation. Download and read the results of our testing for free!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question