I am a member of Account operator group in AD 2003 and 2008 domain. I assume account operators has rights to manage ID's and groups. However, when I try to add any users to any group. Like, I am trying to add user to Domain admin group. I get below error:
You don't have permission to modify this group.
Please advise, why Account operator is not allowed and what is the best way to manage group membership without giving domain admin rights.