Re: Delegate Control... Reset Passwords

I typically do not. What is it that you want them to do with this attribute?

--

JPolicelli, MVP - Directory Services
This posting is provided "AS IS" with no warranties and confers no rights!
http://johnpolicelli.wordpress.com/
----

"Mark Z." <MarkZ@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:C5249BEC-756C-4EB9-84EA-EBA5340B73A1@xxxxxxxxxxxxxxxx
Did you also delegate them permission to the pwdLastSet attribute?

"JPolicelli [MVP-DS]" wrote:

The Account Operators group is the wrong group to use. This group has the
permissions to create/delete InetOrgPerson objects, computer objects,
group objects, and user objects on every OU in the domain by default. The
goal is to reset passwords for users in selected OU's, but not all.

You are headed in the right direction Otto. Your "PCAdmins, Reset
Password, <not inherited>, User Objects" line indicates that you setup the
appropriate permission to meet your goal. If you run the DSACLs command,
what does it show for the PCAdmins group? You should see something like
this for the permission in question:
Inherited to user

Allow DOMAINNAME\PCAdmins Reset Password

Another question...is this problem applicable to password resets for all
users or a subset of users? If it is the latter, check whether the
applicable user(s) is/are a member of a protected group:
Account Operators
Server Operators
Print Operators
Backup Operators
Domain Admins
Schema Admins
Enterprise Admins
Cert Publishers

If they are, then permissions on these objects are not inherited from the
Domain ACL or OU ACLs. You need to delegate permissions on the
AdminSDHolder object.

--

JPolicelli, MVP - Directory Services
This posting is provided "AS IS" with no warranties and confers no rights!
http://johnpolicelli.wordpress.com/
----

"Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
news:ff16fb66e2168cb171bbe074530@xxxxxxxxxxxxxxxxxxxxxxx
> Hello Otto,
>
> Are the not working accounts members of the "Account operators" group?
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>
>> I have a group of admins that are able to reset passwords for users in
>> selected OU's, but not all. Security settings appear the same on all
>> OU's, but these admins all receive the message "Access Denied" when
>> trying to reset passords. Here is my configuration:
>>
>> ADUC = <domain.com>\Admins
>> Security Group - "PCAdmins"; 7 members
>> OU Structure:
>> <domain.com>\Community\Name1\Computers
>> <domain.com>\Community\Name1\Users
>> <domain.com>\Community\Name2\Computers
>> <domain.com>\Community\Name2\Users
>> etc...
>> Security placed on "Users" OU as follows:
>> - PCAdmins, Read/Write Property, <not inherited>, User Objects
>> - PCAdmins, Reset Password, <not inherited>, User Objects
>> - PCAdmins, Read, OU=Community,DC=domain,DC=Com, This object and all
>> child
>> objects
>> - PCAdmins, Create/Delete Computer Objects, DC=domain,DC=Com, This
>> object
>> and all child objects
>> Thank you.
>>
>
>


.

Relevant Pages

  • Re: Moving DCs From Default OU ?
    ... # Jorge de Almeida Pinto # MVP Windows Server - Directory Services ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... although I don't have permissions I can change them back so I ...
    (microsoft.public.windows.server.active_directory)
  • Re: CAS newbie
    ... The production web site is a two server ... If you are impersonating, then you will likely need to implement Kerberos ... Joe Kaplan-MS MVP Directory Services Programming ... code group to give full trust permissions to that dll. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: CAS newbie
    ... It appears that you may need to assert more than ... If you are impersonating, then you will likely need to implement Kerberos ... Joe Kaplan-MS MVP Directory Services Programming ... code group to give full trust permissions to that dll. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Delegate Control... Reset Passwords
    ... You can force replication to make the changes immediately to all DCs. ... want that Admins keep the users password. ... that Read and Write permissions in pwdLastSet attribute. ... >>> goal is to reset passwords for users in selected OU's, ...
    (microsoft.public.windows.server.active_directory)
  • Re: AdminPak installed by Domain User - can view all tabs and grou
    ... Remember also that normal domain users can query the domain using LDAP with ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... The permissions to read the data isn't a risk. ... Is allowing non administrators use of ADUC a risk? ...
    (microsoft.public.windows.server.active_directory)
Loading