Delegating user object changes

[bran]

I need to delegate modifying user (object) properties. I do not want users
that manage ou's to create ids. I will leave that to a production control
group offsite. Could anyone tell me what to select in the wizard for the
following:

user object: no create just modify properties, change password.
groups: create and full control

Can this be achieved from the "delegate common tasks"?

Thx.. L

 

[Chriss3 [MVP]]

Yes if you select customize delegation

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup

 

[LWG]

Chris, could you point out some of the items to be selected? I have gone
down the list a few times and have not been able to achieve the desired
effect. I will work on this more tomorrow...

Thx, L

 

[lforbes]

Chris, could you point out some of the items to be selected? I
have gone
down the list a few times and have not been able to achieve
the desired
effect. I will work on this more tomorrow...

Thx, L

 >>I need to delegate modifying user (object) properties.
I do not want users
 >> that manage ou's to create ids. I will leave that to
a production control
 >> group offsite. Could anyone tell me what to select in
the wizard for the
 >> following:
 >>
 >> user object: no create just modify properties,
change password.
 >> groups: create and full control
 >>
 >> Can this be achieved from the "delegate common
tasks"?
 >>
 >> Thx.. L
 >>
 >>

Hi,

Delegation permissions are shown on a OU under "Advanced View" only.
Under the wizard, add the "Create User" and "Change Password".
Then under View in AD - choose Advanced View (or something like that).
Then right click the OU go to Security. You should see the User in the
list. You can there click Advanced. It may then give you the options
you want.

I am typing this from Memory as I am not sitting at my DC so the
wording may not be exact. I haven’t set advanced permissions beyond
delegating the basics.

Cheers,

Lara