security group...account operators

[Hutch]

We want to give our desktop support access to unlock user
passwords and change user passwords. However, we do not
want to give them rights to modify groups. The account
operators group give them both.

Is there a way to only allow them to do user accounts
administration?

Thanks,
Hutch

 

[Cary Shultz [A.D. MVP]]

Hutch,

Have you considered Delegation?

Cary

 

[Joe Richards [MVP]]

Yes.

Delegate the following to user objects for a group and add the support guys to the group

reset password
write prop for lockoutTime
write prop for pwdLastSet (if you want them to be able to set user must change password on next logon)