Link to home
Start Free TrialLog in
Avatar of defrey
defreyFlag for Australia

asked on

Active Directory - delegate control (WS2012R2)

Trying to get my head around delegation!
I have got an OU (sales) where I delegated access to a user (Fred) which is not part of the Domain admins.
I just want the user to be able to reset password or create user within this OU. All permissions set correctly.

The issue I am having is that I don't know how user (Fred) can login to AD & create those changes.
I tried login on to the server with Fred details but cannot.
I do get 2 errors while trying to login (by the way this is an hyper v DC)

1) The sign-in method you're trying to use isn't allowed. For more info contact your network administrator

or if trying via RDS

2) To sign in remotely, you need the right to sign through RDS, blah..
(as well as adding Fred though RDS group, he also has been added manually to the RDS on the server)

Not sure what I am missing or even why Fred cannot login to the server after being added manually to the remote access on the server.

Avatar of NinjaStyle82
Flag of United States of America image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
to be more clear, there are other ways to allow the remote log on with more granular control, however you should still use rsat.
Avatar of defrey


Hi Ninja,
I mentioned that he was already a member of the remote desktop users group  "as well as adding Fred though RDS group, he also has been added manually to the RDS on the server"

Any others idea?
do they need to have remote log on permission to the DC or will rsat work? RSAT is a better option.
Avatar of compdigit44

I 110% agree with the other experts. If you goal is just to have this user create and reset password, they DO NOT need to log into a DC to do this. They can use RSAT tools from a workstations. Or in are case use the snap-ins via a Citrix hosted app..