[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Giving a user the right to change passwords

Posted on 2010-08-17
5
Medium Priority
?
688 Views
Last Modified: 2012-08-24
I am the admin for a relativley large Windows 2003 network in a school district.  I have 3 Tech aides who are not very thechnical but I would like to give them the ability to change and reset passwords in thier own buildings.  I would like for them to have a custom console so that they can browse AD and change passwords. What is the best way to do this whithout giving them too much access?
0
Comment
Question by:jp_tech
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33453827
Create an OU for that user and delegate permissions for him
0
 
LVL 8

Accepted Solution

by:
SGrossmann earned 750 total points
ID: 33453830
See this article.Delegating permissions within active directory.http://www.windowsecurity.com/articles/Implementing-Active-Directory-Delegation-Administration.html
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33453835
Sorry, on OU where he should be able to chabge passwords, delegate him permissions :)
0
 
LVL 85

Assisted Solution

by:oBdA
oBdA earned 750 total points
ID: 33453877
Right-click the OU in which the user objects are (NOT any domain admins!) and use the delegation of control wizard to allow a group(!) "PasswordReset" or whatever to change the password.
Allow the same group to change the "User must change password" attribute (on W2k3, you do NOT have to edit dssec.dat!), it's not included by default and usually *very* necessary:
Minimum permissions are needed for a delegated administrator to force password change at next logon procedure
http://support.microsoft.com/kb/296999

Create the taskpad (note that the ADUC MMC from adminpak.msi has to be installed on any admin clients, the MMC alone is not enough):
Create Taskpads for Active Directory Operations
http://www.petri.co.il/create_taskpads_for_ad_operations.htm
0
 

Author Closing Comment

by:jp_tech
ID: 33468326
Sgrossman prided a good link that provided instructions for giving the proper delegation and obda provided the information for creating the custom MMC. Thanks guys.
0

Featured Post

Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question