Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What permissions are needed for a helpdesk admin to create users in AD? I don't want this person to be a domain administrator, we have 2003 DCs.

share|improve this question
add comment

2 Answers

Try using Delegate control as i think this will be the solution for fine tuning this access.

Setup the helpdesk admin as a security group in ADUC if not already in place and from there you can then go to view/advanced options, right click an OU to be more specific or the domain as a whole, specify which rights (add users) and include the security group.

Take a look at http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/d7ad344d-0fcf-4a80-9fe0-cac802df25bb for reference.

share|improve this answer
add comment

It's preferable to do this at the OU level by delegating control as Nicholas indicates. If you need to give them the ability to create and manage user accounts and groups everywhere, then there is the BUILTIN\Account Operators group. This group functions like it did in NT4. Because of that, it probably has too many rights for what you're looking for, but I mention it because sometimes that is exactly what folks want, especially when putting in permissions through a 3rd party product.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.