Solved

Granter limited administration priviledges in Active Directory

Posted on 2013-01-24
2
389 Views
Last Modified: 2013-02-04
Hi,

We have a new Tier 1 technician that we want to grant limited privileges in Active Directory, specifically changing user password and creating user accounts.

What would be the best method to accomplish this task?

Thanks!
0
Comment
Question by:jsnrby
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 20

Expert Comment

by:agonza07
ID: 38817353
Do you want to allow to change user password and add new users?
Make him part of the account operators group.

http://technet.microsoft.com/en-us/library/cc756898(v=ws.10).aspx

If you want to disallow these (sorry, I'm not understanding your question properly) then you may need to create a new group and configure the appropiate permissions by delegating access.

http://kpytko.wordpress.com/2012/05/16/active-directory-rights-delegation-overview/
0
 
LVL 17

Accepted Solution

by:
Tony Massa earned 500 total points
ID: 38829744
Do not use "Account Operators".  I would argue against using any builtin groups for anything...other than "Domain Admins".  Even then, NEVER...EVER...use the same account that a user logs on to their computer with.


Account Operators
 
Members of this group can create, modify, and delete accounts for users, groups, and computers located in the Users or Computers containers and organizational units in the domain, except the Domain Controllers organizational unit. Members of this group do not have permission to modify the Administrators or the Domain Admins groups, nor do they have permission to modify the accounts for members of those groups. Members of this group can log on locally to domain controllers in the domain and shut them down. Because this group has significant power in the domain, add users with caution.
Try this instead:http://www.wisesoft.co.uk/software/passwordcontrol/delegating_permissions.aspx
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For anyone that has accidentally used newSID with Server 2008 R2 (like I did) and hasn't been able to get the server running again because you were unlucky (as I was) and had no backups - I was able to get things working by doing a Registry Hive rec…
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question