[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Granter limited administration priviledges in Active Directory

Posted on 2013-01-24
2
Medium Priority
?
409 Views
Last Modified: 2013-02-04
Hi,

We have a new Tier 1 technician that we want to grant limited privileges in Active Directory, specifically changing user password and creating user accounts.

What would be the best method to accomplish this task?

Thanks!
0
Comment
Question by:jsnrby
2 Comments
 
LVL 20

Expert Comment

by:agonza07
ID: 38817353
Do you want to allow to change user password and add new users?
Make him part of the account operators group.

http://technet.microsoft.com/en-us/library/cc756898(v=ws.10).aspx

If you want to disallow these (sorry, I'm not understanding your question properly) then you may need to create a new group and configure the appropiate permissions by delegating access.

http://kpytko.wordpress.com/2012/05/16/active-directory-rights-delegation-overview/
0
 
LVL 17

Accepted Solution

by:
Tony Massa earned 2000 total points
ID: 38829744
Do not use "Account Operators".  I would argue against using any builtin groups for anything...other than "Domain Admins".  Even then, NEVER...EVER...use the same account that a user logs on to their computer with.


Account Operators
 
Members of this group can create, modify, and delete accounts for users, groups, and computers located in the Users or Computers containers and organizational units in the domain, except the Domain Controllers organizational unit. Members of this group do not have permission to modify the Administrators or the Domain Admins groups, nor do they have permission to modify the accounts for members of those groups. Members of this group can log on locally to domain controllers in the domain and shut them down. Because this group has significant power in the domain, add users with caution.
Try this instead:http://www.wisesoft.co.uk/software/passwordcontrol/delegating_permissions.aspx
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

873 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question