Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What permissions are needed for a helpdesk admin to create users in AD? I don't want this person to be a domain administrator, we have 2003 DCs.

share|improve this question

Try using Delegate control as i think this will be the solution for fine tuning this access.

Setup the helpdesk admin as a security group in ADUC if not already in place and from there you can then go to view/advanced options, right click an OU to be more specific or the domain as a whole, specify which rights (add users) and include the security group.

Take a look at for reference.

share|improve this answer

It's preferable to do this at the OU level by delegating control as Nicholas indicates. If you need to give them the ability to create and manage user accounts and groups everywhere, then there is the BUILTIN\Account Operators group. This group functions like it did in NT4. Because of that, it probably has too many rights for what you're looking for, but I mention it because sometimes that is exactly what folks want, especially when putting in permissions through a 3rd party product.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.