Taskpad for password resets

[Will Johnson]

I'm trying to create a taskpad so that users can reset
password for a domain without allowing access to other
functions. Can some please post a link were I and read
this info or let me know if it can be done or not?

 

[Tim Springston [MSFT]]

Hi Will-

Here's an excerpt from the Server 2003 Active Directory Technical Reference:

A custom MMC is useful when a user requires full administrative control of a
particular OU. However, if a user only has permission to perform limited
tasks in a container, the taskpad provides an even simpler management tool.

Creating a taskpad consists of two steps. The first is creating a Taskpad
view, and the second is assigning the tasks that the user can perform on the
objects. To create a taskpad, create a customized MMC that contains the
administrative snap-in that you want to use. Then locate the container where
you have delegated the administrative permissions, and then right-click and
select New Taskpad View. This starts the New Taskpad View Wizard. The Wizard
presents you with options for what types of objects will be displayed in the
taskpad and how the information will be displayed on the screen. After you
have created the view, you can add tasks using the New Task Wizard. This
Wizard allows you to define what types of tasks can be performed by the
users of the taskpad. The list of available tasks depends on the types of
objects that are visible in the taskpad. For example, if you select to view
an OU that contains user accounts, you have the option of assigning tasks
that can be performed on user accounts. As you finish creating the taskpad,
you can also configure the taskpad setting so that the taskpad contains a
very simple interface.

To use the tool, the administrator simply selects a user account and then
clicks Reset Password.

 

[Will Johnson]

Hi Tim-

Thanks for replying.

This is what I've done.
1. created an OU.
2. created a group called support in the OU.
3. created a user in the OU and added the user to the
support group.
4. I then gave reset password and change password rights
to the support group.
I did this by right clicking on the domain and then
properties, group policy, properties, security, Advance.
5. In the permissions window I added the support group and
chose user object in the drop down list. In the user
object list there are two options I need, password reset
and change password. I select both options for the group.
6. After giving the rights to the support group I then log
on to a workstation in the domain with the user in the
support group.
7. I use the taskpad I created on the server that I only
configured to find users in the domain.
8. I then select one of the users to reset the password
and it tells me access denied.

In the support group the user is only a members of the
domain user. My question is, what if any should the
support group be a member of. Or, Is there a step that I
am missing?

Thanks for all your help.

Will Johnson
Dillard's Server Administrator