Editing AD accounts and permissions

[c1utch]

I would like to give our administrative secretary permissions to edit the "General" and "Address" portions of users accounts within Active Directory to ensure our corporate users' info. (Address, phone number, etc) is up to date. However, I don't want her to be able to change any of the other portions of a user's account. Is there a way of doing this or a utility that will allow me to give certain users permissions to interact with accounts, but still be able to keep them locked out of other areas?

Thanks.
Chris


Chris

 

[DStar]

Use and Configure the MMC snapin for ADUAC.. Configure it for the Options required and Assign the user to this.

 

[c1utch]

DStar-

Ok, I've gone to the DC and delegated authority to the user in question. I've also added them as a manager of that particular OU. However, I can't seem to run the DSA.msc snapin from the user's PC. I've tried saving the console settings and using that to run ADUAC with no luck. I want the user to be able to do this from her PC rather than from the server console. Any ideas?

(I'm probably missing something so simple.)

Chris

 

[c1utch]

One last thing...

The error I'm getting when trying to run the snap-in from a client PC is:

MMC
Snap-in failed to initialize.
Name: - not available -
CLSID: {E355E538-1C2E-11D0-8C37-00C04FD8FE93}

After I click "OK", mmc fires up and it looks like the ADUAC snap-in has been included. However, when you try to expand the Domain, there is nothing below it. I tried running dsa.msc from a command prompt with the following switches also:

dsa.msc /domain="my domain"
dsa.msc /server="my server"

Both brought up the same initialization error. I'll keep digging, but any help would be greatly appreciated.



Chris

 

[Cino11]

I had the same problem. You need to run the adminpak.msi located in system32 for Windows 2000 workstions and you can download the one for XP from MS. This will allow you to run the .msc's.

 

[Cino11]

adminpak.msi is loacted on the Windows 2000 server at
%systemroot%\system32. Sorry I wasn't specific enough in the last post.

 

[wpyung]

Is there a way to publish the snap-in for a non-admin user without running the adminpak install ?
I have the same issue.
I want the user to run my taskpad console but not all the tools in the adminpak

 

[dprello]

Log on as local administrator on the computer, change the permissions each admin application the user should not have access to.

start>programs>administrative tools> rightclick a tool you want to restrict, go to security, remove everyone except for administrators of the local machine.

If you have a Citrix environment, your Citrix administrator could easily publish it for you on one of the Citrix servers.