Limited Access to ADU&C for HR?

From: Rube (dont_at_spam.me)
Date: 12/01/04 

Date: Wed, 1 Dec 2004 10:33:57 -0800

Hi All,

I would like to offload everyday management of security group & user
maintenance to a member of our HR team who was a network admin in a previous
life. This person would be allowed to use Active Directory Users & Computers
to add new users & change group memberships in the domain, as well as change
file & folder security in the HR file server. I would prefer not to make
them a domain admin obviously. . .

Any recommendations or caveats? Anyone else do this? What permissions do I
have to give this HR person to allow them to accomplish the above tasks?

TIA,
Rube

Relevant Pages

  • Re: Mapping Drives
    ... > the security group assigned to the user. ... > I created a security group called Quickbooks user ... > then allowed access to the share only if you are a member of the ... >> drives on the file server. ...
    (microsoft.public.windows.server.sbs)
  • Re: Group Policy Wont Apply Unless User is a Member of Domain Admin. Why?
    ... the security group that my test user is a member of. ... you wrote added by default when I created the gpo. ... gpo will only apply if the test user (uTest) is a member of theDomain> Adminssecurity group. ...
    (microsoft.public.windows.server.sbs)
  • Re: Automatically adding computers to a group
    ... their domain computer account password expires. ... security group every time its joined to a domain. ... Interesting concept, "run once GPO. ... that all machines are a member of. ...
    (microsoft.public.windows.server.active_directory)
  • GP/OU Problem/Question
    ... DC and a separate Windows 2003 member server as the TS. ... Create OU & GPO for the TS: ... Make the Security group member of RDU. ... Edit GPO & Setup Edit for test: ...
    (microsoft.public.windows.terminal_services)
  • RE: GP wont apply
    ... to enforce a GP, try making that account a member of Enterprise admins, Group ... >> "To filter the scope of Group Policy according to security group membership ... >> Open the Group Policy object whose scope you want to filter. ...
    (microsoft.public.windows.server.active_directory)