?
Solved

Logon to XP workstations but can reset passwords on an 2003 domain

Posted on 2009-04-02
7
Medium Priority
?
216 Views
Last Modified: 2012-05-06
We have teachers that logon to various workstations in multiple rooms but they need to have an interface each time that will enable them to reset passwords in AD. We do not want them to have admin rights or logon to the server not even using remote. Any ideas how we can make this happen so that it starts when they logon?
0
Comment
Question by:AndyinJapan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 8

Expert Comment

by:Share-IT
ID: 24049417
install the admin pack (adminpak.msi) on the client machines. Give them a short cut that points to dsa.msc.
Then give them the account operators rights on the AD.
0
 
LVL 70

Expert Comment

by:KCTS
ID: 24049431
You can delegate control to them to allow them to change passwords and provide them with a custom taskpad
http://www.petri.co.il/create_taskpads_for_ad_operations.htm
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 24049449

It depends how complicated you want  to get, and how simple it has to be for the teachers.

But you could potentially install the AdminPak on that machine which would give them AD Users and Computers. Creating a group and granting that group the "Reset Password" right on all user objects (or the ones you want them to be able to change).

Chris
0
Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

 
LVL 71

Expert Comment

by:Chris Dent
ID: 24049458

I would avoid Account Operators, they can create / delete accounts as well which seems more than you need?

Chris
0
 
LVL 39

Expert Comment

by:ChiefIT
ID: 24057042
If they have to reset their password each time they logon to a different location, it sounds like they may have passwords changed while logged on from a location or two. Or maybe they have managed passwords on some of these computers.

Really, there shouldn't be much of a need to reset passwords to that extent.
0
 

Author Comment

by:AndyinJapan
ID: 24143862
Hi all,
I can install the admin pack but the issue is with that solution is there are too many PC's to install it to. I had heard of someone setting up the admin pack or at lease something like that when that certain user logon they also got the admin pack installed. I'm not sure if this worked or not...

Many thanks for all your help...
Andy
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 2000 total points
ID: 24145711

It's an MSI file so you should be able to deploy it easily enough using Group Policy if necessary. There are instructions for doing that here:

http://support.microsoft.com/kb/816102

The only change I'd make is that I recommend using this to manage group policy rather than trying to do it through AD Users and Computers:

http://www.microsoft.com/downloads/details.aspx?FamilyID=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en

Chris
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A hard and fast method for reducing Active Directory Administrators members.
Here's a look at newsworthy articles and community happenings during the last month.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Suggested Courses
Course of the Month15 days, 10 hours left to enroll

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question