creating groups with certain rights

[Guest]

Hello all,

I am trying to set up rights (manage printers and change passwords) to a
certain group of users in the domain. I need to remove these users from being
included in the domain admins group, but they still will need access to
perform the functions that I have listed above.

Currently, we are at a Windows 2000 domain. Any help would be greatly
appreciated.

Take care,

Greg

 

[Dave Britt]

Greg,



I would recommend that to provide the Print Management capability you place
all of the users with that requirement into the Built-in group "Print
Operators" to achieve the desired result. With regards to the "Reset
Password" capability you need to consider who's passwords they will be able
to reset, everyone excluding admins ? Lets assume that for a moment, In
order to achieve this you will require standard Users to be in one
Organisational Units lets say "Staff" and administrators in another lets say
"Domain Management" for example. Once the users have been separated into two
Organisational Units create a security group for example ADS_Reset_Passwords
and place the staff needing the capability into the group. Now right click
on the "Staff" Organisational Unit and select delegate and follow the wizard
to provide the reset password capability to the new ADS_Reset_Passwords
group.



This article covers the delegation concept:
http://support.microsoft.com/default.aspx?scid=kb;en-us;315676&sd=tech

Start experimenting in a test environment and then back with any Questions

Dave