Administrator's group/Permissions

[efector]

OK.......I currently have Help Desk employees who are members of the DOMAIN ADMINS group, and when I look at the BUILT IN OU/ADMINISTRATORS of my domain, they are also listed in there(each name)as well (along with the Domain Admins Group/Enterprise Admins Group).

I only want them to be able to reset password and create computer accounts, so I've used the delegate control feature, and created a group called HELP DESK.

SO, under the BUILT IN/Administrators, WHO should be in that user group? Is it safe to delete everyone except the Domain Admins/Enterprise Admins group?

The challenge is that I need ordinary Domain Users to be able to be LOCAL ADMINS on the desktops/laptops.


HELP!!!

 

[bustamove]

put them into account operator group is good enough. no need to set delegation

 

[efector]

no, i think I want to use the delegation wizard. I only want them to be able to create computer accounts and reset password. Account Operators can delete accounts, etc

 

[bustamove]

then you don't need them to be in DC builtin admin group.
you can add help desk group in the administrators group of each workstation.

DC builtin admin group it is like the local administrators group for domain controller. say you need to logon to DC box to change something.