Security

Ask something
Discussion Locked

permissions for resetting passwords

0 helpful
7 replies

by auxperc

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Is there a way to create an account that would be able to reset admin passwords without giving them rights as domain admins. we are trying to keep the number of people with admin rights to a minimum. We are running in native mode and use active directory.

7 replies

by d.walker5

As I understand your question is asking how to change user accounts added to the Built-In Administrators Local Group? This can be done through the Delegation of Control Wizard. This wizard allows you to delegate management of AD objects to a security group that isn?t explicitly a member of the Administrators local group. You access the Delegation of Control Wizard by right clicking the Administrators container in Active Directory Users and Computers and selecting Delegate Control. Under Tasks to Delegate you?ll find an option for resetting passwords. As an alternative, you can manually delegate permissions from the Advanced options on the AD container?s Security tab, remember the Security tab is available only when Advanced Features are enabled in AD Users and Computers.

I hope this helps?

by josh4174

well anyuser can change password if they have ctrl alt delete then click change password unless u have the user set to user cannot change password

This discussion is closed to new replies.