password help

[Will Johnson]

I need help giving password reset rights to users in a
domain. I don't want to give these users Admin rights.
What is the best way to do this? Please help.

This is what I've done.
1. created an OU.
2. created a group called support in the OU.
3. created a user in the OU and added the user to the
support group.
4. I then gave reset password and change password rights
to the support group.
I did this by right clicking on the domain and then
properties, group policy, properties, security, Advance.
5. In the permissions window I added the support group and
chose user object in the drop down list. In the user
object list there are two options I need, password reset
and change password. I select both options for the group.
6. After giving the rights to the support group I then log
on to a workstation in the domain with the user in the
support group.
7. I use the taskpad I created on the server that I only
configured to find users in the domain.
8. I then select one of the users to reset the password
and it tells me access denied.

In the support group the user is only a members of the
domain user. My question is, what if any should the
support group be a member of. Or, Is there a step that I
am missing?

 

[\Richard McCall [MSFT]\]

This article should help
296999 Minimum Permissions Are Needed for a Delegated Administrator to Force
http://support.microsoft.com/?id=296999