Custom Delegation in AD

From: kusdjeff (kusdjeff_at_discussions.microsoft.com)
Date: 09/23/04 

Date: Thu, 23 Sep 2004 11:59:03 -0700

I have a question about AD delegation. I am in the process of creating an AD
custom delegation (modifying the delegwiz.inf). I am able to set all the
rights for my environment except one. How do I enable (delegate) my users
the ability to enable/disable accounts. I understand that there is a
'userAccountControl' option, but this grants too many rights. I only want my
users the ability to enable/disable accounts without affecting other rights
such as "Password Never Expires" and "User Cannot Change Password". How do I
go about doing this??

Thanks in advance, Jeff

Relevant Pages

  • Re: Limiting Access Rights to AD from Windows 2000 Professional
    ... I've done the DELEGATION WIZARD. ... to review user information and change password. ... the user access her MMC console she can make changes to ... Can she have more rights flowing downwards that is ...
    (microsoft.public.win2000.active_directory)
  • Re: Custom Delegation in AD
    ... You can set up a proxy system where the admin contacts a web page or uses some ... The delegation has to be to the entire attribute or not at all. ... but this grants too many rights. ... >>>users the ability to enable/disable accounts without affecting other rights ...
    (microsoft.public.windows.server.security)
  • Re: Limiting Access Rights to AD from Windows 2000 Professional
    ... to do a customize delegation within the wizard. ... > to review user information and change password. ... > the user access her MMC console she can make changes to ... > overwriting the rights on a particular OU? ...
    (microsoft.public.win2000.active_directory)
  • Re: Mapping to W2003 user rights/access?
    ... > when it comes to access/user rights. ... I believe Clustering should need maximum Adminrights on the Cluster. ... > 6) Is there a granular delegation setting or something ... I wouldn't even use Account Operators, ...
    (microsoft.public.windows.server.migration)
  • Re: Delegate control questions
    ... help of Delegation Of Control Wizrad. ... Yes it was a replciation problem, Now I can see all computers ... noticed that if the local admin creates an own mmc with ADUC snap he will ... se the whole AD but have only rights to do something in his OU ...
    (microsoft.public.windows.server.active_directory)