Windows Forum

Ask something
Discussion Locked

NT 4.0 Administrative Privileges

0 helpful
1 reply

by pete.zerger

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I want to give a goup of IT users the right to create Domain user accounts without making them Domain Admins. I dont want them to have capability to add / remove users from Domain Admins group.

Is there any way to do this?

1 reply

by banyanman

Sure is. NT 4 has built in Domain Local Group called Account Operators. Add the users that need to create and manage accounts to this group. Since the priveledge to add users to the Domain Admins and Administrator groups is at a higher level, they cannot modify these two groups or any accounts that are members of the two. If the account operators do not use the remote tools, then you may need to adjust your domain security settings to allow them to log on locally to a dc to make account changes. HTH.

This discussion is closed to new replies.