Solved

Limited domain admin account?

Posted on 2010-09-03
2
396 Views
Last Modified: 2012-05-10
Hello Experts,

I'd like to create an account for a junior admin person but would only like to give him access to reset account passwords, reset account lockouts, etc...   but would not want to use a domain admin account.  What's the best method/way to provision such an account?  I don't want to give the admin too much permissions, but just enough to provide helpdesk password reset ability.
0
Comment
Question by:taki1gostek
2 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 500 total points
ID: 33598201
Good move definitely don't give him domain admin rights.  You can use the delegation control wizard in ADUC to give him rights.  You can also extend the delegation control wizard
http://adisfun.blogspot.com/2009/08/extend-ad-delegation-control-wizard.html
In that entry I have links to the Microsoft delegation docs.
If the junior admin ever control all aspects of accounts you can also add him to "account operators"...note account operators can't change/modify the DA group..that is a good thing
Thanks
Mike
0
 
LVL 2

Author Closing Comment

by:taki1gostek
ID: 33599057
Awesome, just what I was after.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
Synchronize a new Active Directory domain with an existing Office 365 tenant
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question