Solved

Give HR Employees Access to Edit Active Directory Info

Posted on 2011-02-25
2
2,324 Views
Last Modified: 2012-06-21
What is the best method to give our HR employees access to edit some minor Active Directory information in our AD 2003 Environment? We would primarily like them to edit the Organization tab to update our organizational structures.

Also - once access is granted, what is the best tools/utilities to load on their computers so that they may edit AD info?

Thank you -
0
Comment
Question by:RavenInd
2 Comments
 
LVL 12

Assisted Solution

by:Navdeep
Navdeep earned 200 total points
ID: 34983992
Hi,

You can create a security group and then use "Delegate Control" to give required level of control to modify and update Organization Tab Attribute.

Users can use Adminpack, or just the directory services users and computers snapin to update the changes.
0
 
LVL 35

Accepted Solution

by:
Joseph Daly earned 300 total points
ID: 34994067
I would also agree with v-2nas that delegation of permissions is the way to go.

Give this a quick read through for the basics. If you have any specific questions post back.
http://www.windowsecurity.com/articles/Implementing-Active-Directory-Delegation-Administration.html

As far as what tool to manage the users the HR employees will be using the acitve directory users and computers snap in to modify the accounts. However depending on how you have your OU structure configured you may be able to go even one step further and create a custom MMC for them.

This custom MMC can be useful if all of your user accounts are in the same OU. You can set this MMC to only open to that location and they will not be able to even browse the other OUs.

http://www.petri.co.il/create_taskpads_for_ad_operations.htm

A little more info on the custom MMC
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
powershell mailbox move question 8 50
Activity directory migration 4 23
Script to find any empty OU and nested OU in Active Directory 2 64
Multiple Errors from DCDIAG 2 21
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question