Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Minimum rights required in Active Directory

Posted on 2009-05-14
3
Medium Priority
?
640 Views
Last Modified: 2012-05-07
Hello all,

I'm trying to figure out the minimum required rights a help desk worker should have to be able to move users and create new mailboxes. Thanks!
0
Comment
Question by:hmcnasty
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 1000 total points
ID: 24387784
What other tasks would they be doing with user accounts?
There is a builtin-group called account operators (that may be to much power though)
http://technet.microsoft.com/en-us/library/cc756898.aspx
Account Operators
Members of this group can create, modify, and delete accounts for users, groups, and computers located in the Users or Computers containers and organizational units in the domain, except the Domain Controllers organizational unit. Members of this group do not have permission to modify the Administrators or the Domain Admins groups, nor do they have permission to modify the accounts for members of those groups. Members of this group can log on locally to domain controllers in the domain and shut them down. Because this group has significant power in the domain, add users with caution.
We have about 20 people in our help desk.  Two of them do account maintenance and they are in this group.  
Thanks
Mike
0
 
LVL 22

Assisted Solution

by:Paka
Paka earned 1000 total points
ID: 24393913
Configuring a user or helpdesk to manage user accounts and mailboxes can be done but it's a moderately difficult task.  In short, you will need to create a group such as "HelpDeskGroup" and delegate Exchange View Only Adminstrator rights to it (don't let the name concern you) using ESM.  Next, you will need to delegate the appropriate rights to that group - this is the tough part and is detailed in the link below.  Lastly, add the individual Help Desk accounts to the HelpDeskGroup.

Here's a link detailing the appropriate rights needed for mailbox delegation:
http://groups.google.com/group/microsoft.public.exchange.admin/browse_thread/thread/89170c9c159e81f3
0
 

Author Comment

by:hmcnasty
ID: 24424296
Thanks guys, this has been very helpful.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question