2

I want to create an user of our domain controller (Windows Server 2008) so that he can create and delete any domain users other that those granted administrator rights, how to do that?

2
  • 1
    Can you clarify "those granted administrator rights" - do you mean the Domain Admins group? Dec 5, 2012 at 2:06
  • Yes, I mean the domain admins group. At the moment, I am the only one user granted permission to create/delete users. I would like to give the same rights to another user, but I don't want him to be able to delete me. Dec 5, 2012 at 2:25

1 Answer 1

5

You put all of your administrative users in one OU, then put all others in another OU or tree of OUs. Then, delegate permission to the user/group to create/delete objects in the non-administrative OU by right clicking on the OU and selecting "delegate permissions"

5
  • 2
    Yep, simple as this. Please though, delegate the permissions to groups, not individual users. In fact, if you can, create groups dedicated for this specific admin delegation, then populate this new group with the required admin users. You'll be happy later when you have to add/remove users from this admin delegation right.
    – jscott
    Dec 5, 2012 at 2:13
  • AdminSDHolder will also contribute to keeping users with delegated rights from touching users who hold an administrative group membership in the domain. Dec 5, 2012 at 2:50
  • Very true, but AdminSDHolder only protects members of privileged groups. If the OP doesn't want users delegated this way to be able to delete other users delegated this way, then they should be separated by OU.
    – MDMarra
    Dec 5, 2012 at 2:52
  • Can someone explain to me what does it mean by "delegate delegate permission to the user/group"? Dec 5, 2012 at 6:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .