I want to create an user of our domain controller (Windows Server 2008) so that he can create and delete any domain users other that those granted administrator rights, how to do that?
-
1Can you clarify "those granted administrator rights" - do you mean the Domain Admins group?– Shane MaddenDec 5, 2012 at 2:06
-
Yes, I mean the domain admins group. At the moment, I am the only one user granted permission to create/delete users. I would like to give the same rights to another user, but I don't want him to be able to delete me.– Chris HuongDec 5, 2012 at 2:25
Add a comment
|
1 Answer
You put all of your administrative users in one OU, then put all others in another OU or tree of OUs. Then, delegate permission to the user/group to create/delete objects in the non-administrative OU by right clicking on the OU and selecting "delegate permissions"
-
2Yep, simple as this. Please though, delegate the permissions to groups, not individual users. In fact, if you can, create groups dedicated for this specific admin delegation, then populate this new group with the required admin users. You'll be happy later when you have to add/remove users from this admin delegation right.– jscottDec 5, 2012 at 2:13
-
AdminSDHolder
will also contribute to keeping users with delegated rights from touching users who hold an administrative group membership in the domain. Dec 5, 2012 at 2:50 -
Very true, but AdminSDHolder only protects members of privileged groups. If the OP doesn't want users delegated this way to be able to delete other users delegated this way, then they should be separated by OU.– MDMarraDec 5, 2012 at 2:52
-
Can someone explain to me what does it mean by "delegate delegate permission to the user/group"? Dec 5, 2012 at 6:49
-
@ChrisHuong technet.microsoft.com/en-us/library/cc773318(v=ws.10).aspx– MDMarraDec 5, 2012 at 11:38