Re: Delegate Control... Reset Passwords

Did you also delegate them permission to the pwdLastSet attribute?

"JPolicelli [MVP-DS]" wrote:

The Account Operators group is the wrong group to use. This group has the
permissions to create/delete InetOrgPerson objects, computer objects,
group objects, and user objects on every OU in the domain by default. The
goal is to reset passwords for users in selected OU's, but not all.

You are headed in the right direction Otto. Your "PCAdmins, Reset
Password, <not inherited>, User Objects" line indicates that you setup the
appropriate permission to meet your goal. If you run the DSACLs command,
what does it show for the PCAdmins group? You should see something like
this for the permission in question:
Inherited to user

Allow DOMAINNAME\PCAdmins Reset Password

Another question...is this problem applicable to password resets for all
users or a subset of users? If it is the latter, check whether the
applicable user(s) is/are a member of a protected group:
Account Operators
Server Operators
Print Operators
Backup Operators
Domain Admins
Schema Admins
Enterprise Admins
Cert Publishers

If they are, then permissions on these objects are not inherited from the
Domain ACL or OU ACLs. You need to delegate permissions on the
AdminSDHolder object.

--

JPolicelli, MVP - Directory Services
This posting is provided "AS IS" with no warranties and confers no rights!
http://johnpolicelli.wordpress.com/
----

"Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
news:ff16fb66e2168cb171bbe074530@xxxxxxxxxxxxxxxxxxxxxxx
Hello Otto,

Are the not working accounts members of the "Account operators" group?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


I have a group of admins that are able to reset passwords for users in
selected OU's, but not all. Security settings appear the same on all
OU's, but these admins all receive the message "Access Denied" when
trying to reset passords. Here is my configuration:

ADUC = <domain.com>\Admins
Security Group - "PCAdmins"; 7 members
OU Structure:
<domain.com>\Community\Name1\Computers
<domain.com>\Community\Name1\Users
<domain.com>\Community\Name2\Computers
<domain.com>\Community\Name2\Users
etc...
Security placed on "Users" OU as follows:
- PCAdmins, Read/Write Property, <not inherited>, User Objects
- PCAdmins, Reset Password, <not inherited>, User Objects
- PCAdmins, Read, OU=Community,DC=domain,DC=Com, This object and all
child
objects
- PCAdmins, Create/Delete Computer Objects, DC=domain,DC=Com, This
object
and all child objects
Thank you.




.

Relevant Pages

  • Re: Delegated Authority
    ... > create a new mmc, add the snap in and path to the desired OU and chose new ... > I then click on Delegate control, this brings up the wizard and I add the ... then select the permission (I.e. reset password) and save the mmc ...
    (microsoft.public.win2000.active_directory)
  • Re: management rights for account.
    ... ・first, in the Active Directory Users and Computers Console, select "view", then "Advance Feature" ... ・then, you can see MORE tabs in the Object Properties than before, in the security tab, you got a way to assign "reset password" permission to your helpdesk personal ... so sometimes you could take a think if you can give the helpdesk people some more permission, so that you can assign to them more effect and fast ...
    (microsoft.public.cert.exam.mcse)
  • Re: Reset Password: Access Denied
    ... reset password is the operation that admins perform - you ... reset the password without knowing what it is. ... little to undo that permission. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Delegating Control...
    ... Reset user passwords ... domain user has permission to join 10 clients into domain. ... You may want to delegate user/group create, list, view permission to the ... You may want to delegate users/groups full control permission to the groups ...
    (microsoft.public.win2000.active_directory)
  • Re: VBScript runtime error: 800A0046 Permission denied: GetObject
    ... Can you get it to echo the strDomain, strUserName values? ... Dim SMSNetwork ... "Domain Admins") Then MapLDrive = FALSE ... Directory I need to go to re-establish permission. ...
    (microsoft.public.windows.server.active_directory)
Loading