Unable to reset user accounts--permission denied

[jms1885]

We delegated the rights for password resets to our help desk a few months back. Since then, we've found a small number of user accounts that our help desk is unable to reset; they get a "Permission denied" error each time that they try. This is only for a handful of user accounts and I'm able to reset the same accounts with no problems.

The accounts in question are located in the multiple OUs, each of which has had the proper delegation for resets. The help desk is able to reset other accounts in those OUs with no problems, just not these few problem ones. For test purposes, I've created identical accounts (same group membership, permissions, etc) for each problem account and our help desk can reset those with no problems.

At this point, I'm at a loss for an explanation. Has anyone run across this problem before?

 

[adcfaq]

you may use dsacls to trace down the exact ACLs of those users that denied your helpdesk guy.

http://www.microsoft.com/technet/pr...Ref/ffd71dba-386e-463e-9529-f0b77d708ca0.mspx

question here: domain admin can reset those password, er?

---------------------------------------
Sr. Directory Services/Exchange Consultant

http://adcfaq.8m.com/

 

[jms1885]

benlu,

I haven't tried a reset using a domain admin account since we did the AD delegation. For security purposes, we removed nearly all accounts from the domain admin group--mine included.

When necessary, I sign on with one of the few remaining accounts in the domain admin group. I haven't tried it in this case because I was able to reset the problem accounts using my regular ID.