Delegation

G

Guest

I want to delegate the User account management tasks in Active Directory
Domain to Helpdesk agents.
For this activity I am using the builtin group called Account operators but
after adding helpdesk agents User ID into Account operators group he is able
to change the password of all domain admin accounts,delete them,rename etc.In
short he is able to do all activities on domain admin accounts and I want he
should not able to do anything with domain admin accounts but he should
continue to do the delgated task on all othe user accounts.

Even I tried with delegation wizard on main domain tree but still the
results are the same.
Can anybody suggest better method or any schema modifications?
 
G

Guest

Best bet is to move your Domain Admin Accounts to a different OU, and don't
delegate authority to that OU. You can remove delegations by right-clicking
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

How to block Domain Admin Accounts deletion by Account Operators 3
Rights -Account Operators 1
Delegation Rights ? 1
Prevent some Domain Admin Account from creating USERS, Groups, OUs 2
not saving security settings 3
Account Operators Group 15
AD design question....again 4
Unable to log on with a domain account 3

Top