3

I am trying to get a junior team mate setup with rights on AD to create accounts, change passwords and create emails on exchange. What would be the best way to do this?

I tried half assing a delegation but I am not sure how to do it, so I stopped and backed out.

Can someone point me to an answer if they know the best way.

Thanks

Improve this question

4 Answers 4

Reset to default
3
  1. Survey the different collections of management tasks you need in AD.
  2. Create AD Security groups to represent these tasks.
  3. Delegate permissions, on OUs, to these groups based on role requirements.
  4. Populate groups with users that will perform management tasks.

In our K12 domain, we've delegated out separate groups for managing staff user accounts, student user accounts, building computers and multiple server management groups.

Improve this answer
1
  • +1 - You said the magic words re: using groups.
    – Evan Anderson
    Dec 8, 2009 at 20:20
1

You're on the right track. Right click the domain, container, or OU where you want to give the junior admin delegated rights and select Delegate Control, click Next, add the user and click OK, click Next, select the first three checkboxes, click Next, then click Finish. The junior admin will now be able to create and manage user accounts, reset passwords, and read all user account information. You can get as granular with Delegated Control as you want or need but this should at least get you what you need for the time being.

Improve this answer
2
  • 3
    I'd give you a +1, but I have one beef. Never, ever, ever, ever, ever, ever, ever name individual users in permissin delegations. Create a group for the purposes of the delgation, name the group in the delegation, and put the appropriate user in the group. All permissions should be assigned to groups for very nearly any kind of resource. (User home directories are the only exception in my world...) Using groups lets you easily replicate permissions for new users / turnover / etc.
    – Evan Anderson
    Dec 8, 2009 at 20:19
  • @Evan: There are no absolutes in life or IT. You're right though, I should have recommended using a group.
    – joeqwerty
    Dec 8, 2009 at 20:51
0

The definitive guide on this topic is available from Microsoft here:

Best Practices for Delegating Active Directory Administration

Improve this answer
-2

There's an article on this issue:

Active Directory Delegation. It explains a scope of activity of a third party solution, I should admit.

Thank you.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .