1

My question is rather simple: How can I assign the right to a Windows Server user to create/manage Active Directory Users?

I am using Windows Server 2008 R2.

Thanks for your help!

PS: I moved this question from stackoverflow to serverfault: https://stackoverflow.com/posts/7429832

Improve this question
1

1 Answer 1

Reset to default
5

I assume you do not want to make them a Domain Admin. So the right way to do this is with the Delegation Wizard. Go to the OU where you want to delegate control (if you have no OUs or want to grant this right for the entire directory, go to the root of the tree).

When you get to the Tasks to Delegate pick at least Create, Delete and manage user accounts. Look at the list for other tasks. Click through to complete the wizard.

Improve this answer
3
  • 1
    This is absolutely correct, but depending on the level of trust you have in said person you can also just place them in the pre-defined "Account Operators" group.
    – SpacemanSpiff
    Sep 15, 2011 at 18:02
  • Good point. One can use Account Operators if you want to give someone global Acct Mgmt rights. If you need to restrict them to specific OUs, the Delegation wizard will would be necessary.
    – uSlackr
    Sep 15, 2011 at 20:00
  • It is recommended to not use Account operators Group, and use elegation instead. From Microsoft docs: This group (Account operators) is considered a service administrator group because it can modify Server Operators, which in turn can modify domain controller settings. As a best practice, leave the membership of this group empty, and do not use it for any delegated administration.
    – trogper
    Apr 10, 2021 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .