Active Directory Permissions

[Beau71]

I am setting up AD security for our new Helpdesk.
I added the group to Account Operators so they would be able to reset passwords and create accounts. However, Account Operators is not able to Enable/Disable accounts. How would I enable this group to perform this?

We have a complex AD structure with many OUs and sub-OUs.

 

[markdmac]

Use the delegation wizard.

An alternative is to use ASP pages that have admin rights. Use NTFS permissions to restrict who has access to the pages. I've done this for a number of customers. It allows me to give non-admins specific abilities through custom tools rather than assigning their IDs elevated rights.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[Beau71]

Delegation Wizard worked great, thanks!

However, this group is not allowed to create Exchange Mailboxes when creating a new user.

 

[markdmac]

Exchange has its own security. You will need to assign rights to manage Exchange.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.