Delegate Control... Reset Passwords

I have a group of admins that are able to reset passwords for users in
selected OU's, but not all. Security settings appear the same on all OU's,
but these admins all receive the message "Access Denied" when trying to reset
passords. Here is my configuration:

ADUC = <domain.com>\Admins
Security Group - "PCAdmins"; 7 members

OU Structure:
<domain.com>\Community\Name1\Computers
<domain.com>\Community\Name1\Users
<domain.com>\Community\Name2\Computers
<domain.com>\Community\Name2\Users
etc...

Security placed on "Users" OU as follows:
- PCAdmins, Read/Write Property, <not inherited>, User Objects
- PCAdmins, Reset Password, <not inherited>, User Objects
- PCAdmins, Read, OU=Community,DC=domain,DC=Com, This object and all child
objects
- PCAdmins, Create/Delete Computer Objects, DC=domain,DC=Com, This object
and all child objects

Thank you.
.

Relevant Pages

  • RE: lost password & Active Dir
    ... admins" group from the local administrators group, Logon as an ... > to access the Active Dir to go in and reset passwords. ...
    (microsoft.public.win2000.security)
  • Re: Delegate Control... Reset Passwords
    ... I'm reading this as users do not have the right to reset passwords for certain objects while they do other objects in the same container. ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... Always test ANY suggestion in a test environment before implementing! ... Security settings appear the same on all ...
    (microsoft.public.windows.server.active_directory)
  • Limited access
    ... I would like to limit the number of Admins on a memberserver. ... as reboot the servers. ... I've look at the System and security settings ...
    (microsoft.public.windows.group_policy)
  • Re: Non-"Administrators" cannot log in at this computer/workstation
    ... It sounds like you were messing around in the security settings, ... changed some setting that has locked out all accounts except admins. ...
    (microsoft.public.windowsxp.security_admin)
Loading