Re: Win2k - Account Operator not working properly

You shouldn't use acc ops because there are side effects that tend to mess people up (see adminsdholder functionality) plus it was put there simply as a holdover from NT.

The proper way to handle this is to create one or more groups and delegate the permissions needed to those groups and add admins to the groups as needed.

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


thawkz wrote:
Running (an inherited) Windows 2000 Active Directory.
Helpdesk staff needed permissions to manage user account/reset passwds, etc.
Added Helpdesk staff users to Account Operators built-in group.
Helpdesk staff still not able to manage user accounts/passwords, etc.
Used the Delegate Control wizard as workaround...... but I would like to fix the issue with Account Operators--how can I make the sure the Account Operators built-in group has all of the required permissions? What settings do I check and where? (I suspect some of the default permissions for the Account Operators group have been modified, but I have no idea which ones....).
Thanks.

.

Relevant Pages

  • Re: Account Operators Group does not have permissions to users
    ... Every normal user should have an ACE that grants special permissions to the ... Account Operators group on the user object. ... if MWilson is made a member of Account ...
    (microsoft.public.windows.server.active_directory)
  • Re: Account Operator Security Rights
    ... more than just changing group memberships ... "Account Operators" was already included on that tab with "Full Control" rights. ... When the user tested this they got a message stating that they did not have security permissions to make changes to the list. ...
    (microsoft.public.windows.server.active_directory)
  • Access Denied LDAP Provider 8007005
    ... I have the XP 2003 Exchange tools loaded on our account operators ... Microsoft Active Directory - Exchange Extension ... extensions which is does not have the right permissions. ... ASSIGN COMPUTER MANAGEMENT RIGHTS: ...
    (microsoft.public.exchange.admin)
  • Re: remove delete a user account permissions from an Account Ope
    ... My approach would be to search through all the standard AD OUs and containers and see what permissions were granted to the Account Operators groups and then apply the same permissions to the same place as you find Account Operators entries. ... I want to create a security group exactly identical to the Account Operator ... where can I find the list of all permissions (in the delegate control ...
    (microsoft.public.windows.server.active_directory)
  • Domain Local Groups - Windows Server 2003
    ... What Domain Local Group would it be safe to dumb a helpdesk staff in? ... don't see a Power Users group and am assuming that the Account Operators ...
    (microsoft.public.windows.server.general)
Loading