Re: Grant right to unlock accounts?

Hello Bob,

How To Delegate the Unlock Account Right:
http://support.microsoft.com/kb/294952/en-us

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

Hello,

Can you please help me find settings in AD for Windows Server 2003 to
allow one of my domain user containers to have admin rights to let
them use the AD User snap-in on their XP workstation to reset
passwords and unlock users?

At the moment user in this container have the ability to reset the
password but if the account is locked they cannot uncheck the "unlock
account" item as it is grayed out. I have tried to apply the setting
in ADSI for Password LockoutTime read and write but it is not working.
That is, I tried to follow the advice of "method 2" in this article
http://support.microsoft.com/kb/279723

Also I would like these users to be able to rename domain member
workstations.

Thank you for any advice you can give me.
-Bob


.

Relevant Pages

  • Re: Password Reset and Unlock unable to disable..
    ... Even though the pick is there, if the delegation is done correctly they will not be able to do a reset or unlock. ... Even under the Account tab the option user must change the password for the next logon is not deem. ... and I have don;t have the full administration access to modify certain group or security permission but I able to view it. ...
    (microsoft.public.win2000.active_directory)
  • Re: Unlock accounts in same security group - account operators
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... unlock one anothers accounts? ... not if they are in the Account Operators group. ... Delegating the read/write lockout time option does not work as the ...
    (microsoft.public.windows.server.active_directory)
  • Re: Giving rights to a group to reset and unlock users in a AD domain
    ... To reset password use the "delgate control" wizard and also use the settings in the article to give the permissions to unlock accounts: ... The AdminSDHolder process runs on some protected groups and removes delegated permissions and inheritance if set. ... "Account Password Reset group" and I need to give them the right to ...
    (microsoft.public.windows.server.active_directory)
  • Re: Account Lockout
    ... "How to Grant Help Desk Personnel the Specific Right to Unlock Locked ... the reset it executed and the flag is cleared. ... bactchjob that calls CHOICE to ask "reset account ". ... >user account (local computer, not domain user account) ...
    (Security-Basics)
  • Giving rights to a group to reset and unlock users in a AD domain
    ... I am trying to add this group of users, who we are calling the "Account ... Password Reset group" and I need to give them the right to reset any ... only reset and unlock users within their own "Account Password Reset ...
    (microsoft.public.windows.server.active_directory)