We are trying to delegate certian tasks to our helpdesk team through AD.
We would like them to be able to reset passwords,unlock accounts, and enable/disable accounts.
I have the password reset and unlock accounts figured out. The delemia is two part though.
First we would like to find a way to disable the “Email:” setting on the general properties page. I have tried to set “Read/Write Email Address (Other)” with no luck (yes I did test to make sure it wouldn’t just error out when they attempted to apply changes).
And secondly we would like to give them the ability to enable/disable accounts for one of our OU’s. I know the user account control permission can do that but it all so gives them to ability to to edit other things we’d rather not have them do. (give user ability to change password, and set expiring passwords)
Also on a quick side note, I would like for them to only see the object we give them permission to edit when they open AD. The best I have come up with for this is to edit the security on each OU to deny list rights. This allows them to still see the OU’s but as far as they are concerned it might as well be empty. If anyone has a better solution to that let me know.