[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 411
  • Last Modified:

Granter limited administration priviledges in Active Directory

Hi,

We have a new Tier 1 technician that we want to grant limited privileges in Active Directory, specifically changing user password and creating user accounts.

What would be the best method to accomplish this task?

Thanks!
0
jsnrby
Asked:
jsnrby
1 Solution
 
agonza07Commented:
Do you want to allow to change user password and add new users?
Make him part of the account operators group.

http://technet.microsoft.com/en-us/library/cc756898(v=ws.10).aspx

If you want to disallow these (sorry, I'm not understanding your question properly) then you may need to create a new group and configure the appropiate permissions by delegating access.

http://kpytko.wordpress.com/2012/05/16/active-directory-rights-delegation-overview/
0
 
Tony MassaCommented:
Do not use "Account Operators".  I would argue against using any builtin groups for anything...other than "Domain Admins".  Even then, NEVER...EVER...use the same account that a user logs on to their computer with.


Account Operators
 
Members of this group can create, modify, and delete accounts for users, groups, and computers located in the Users or Computers containers and organizational units in the domain, except the Domain Controllers organizational unit. Members of this group do not have permission to modify the Administrators or the Domain Admins groups, nor do they have permission to modify the accounts for members of those groups. Members of this group can log on locally to domain controllers in the domain and shut them down. Because this group has significant power in the domain, add users with caution.
Try this instead:http://www.wisesoft.co.uk/software/passwordcontrol/delegating_permissions.aspx
0

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now