Reset Passwords w/o permissions to delete

[Jason]

I am needing to setup a user profile that only has access
to reset passwords in Active Directory. My helpdesk
can't seem to not delete users so I need to deny all
delete and create permissions for the entire domain. I
thought I changed up the permissions correctly, but I
guess not. They cannot make any changes to any users.

Any ideas?

 

[Herb Martin]

In AD Users and Computer the (right click) Delegation Wizard has
a standard method (one of 6 or 10) for reset/change passwords.

Make a group (e.g., Help Desk) and delegate this authority to that group
using the Delegation of Control Wizard.

Consider making an OU (design) so that you can delegate only for
specific users. Ensure that Help Desk members are not Admins.