Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to give one user a limited set of administrative rights.

The suer must be allowed to:

  • create users
  • create folders
  • share folders
  • able to take back up

I do not want this account to be able to:

  • delete users,
  • delete existing files/folders
  • modify existing files/folders

If I add a user to the Domain Admins group this gives them more rights then they need.

share|improve this question

This is called "Delegation of Administration". If you want this user limited control over Active Directory OU's simply right click on that specific OU/forest and choose "Delegate Control"

This security wizard will then ask for username and then ask what controls you would want to delegate. In your case to split the create and delete controls you may have to create custom controls. In custom controls, select the active directory object types you want the user to have access to and then choose whether you want them to have add/remove controls.

share|improve this answer
+1 Better off creating a group to delegate these rights to and not directly to the user... just in case your plan extends to >1 user. – ST8Z6FR57ABE6A8RE9UF Apr 14 '11 at 6:04

Yes, it is possible to do this using fine-grained permissions in Active Directory. However, there's a good reason this isn't commonly done.

If you're giving a person the rights to manage user accounts and take backups, that implies a certain amount of trust. If you're only giving them half the rights they need, it's like saying "I don't trust you to do this job, but I'm making you do it anyways."

As an alternative, you could delegate management of a single organizational unit. This way the potential damage is still limited, but now you have a chance to evaluate this person's administrative ability. For more information, try searching Google for "Active Directory delegate control organizational unit".

If you're absolutely set on giving a user the ability to create other user accounts but not delete them, then you'll need to manually edit the ACLs on an organizational unit and grant that user the "Create User objects" privilege.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.