Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a situation where we need to deny domain admins from resetting passwords of users in a specific OU...

This is not a regular request.. Any idea?

share|improve this question

2 Answers 2

You can do this by enabling advanced settings, and then right clicking on the OU and going to properties then security then advanced and configure Domain Admins with a deny for the password reset option

Word of warning i would suggest not denying domain admins, if there is a group of people in the domain admin group who you dont wish to do this then add them to a group and deny that group access

share|improve this answer
Will this work for sure? If i make this change but the user still has permission to create delete and delete users, won't he have the right to reset passwords anyway? – user57657 Oct 20 '10 at 9:46
no create and delete users are different than changing a password, although he could delete the user then recreate him with a new password - and one thing to remember a Deny ALWAYS overrides an Allow hence why I suggested making another group for the deny – Trozz Oct 20 '10 at 12:01

Pretty sure you can do this if you adjust delegation for this ou.

share|improve this answer
That's the thing, we need to provive delegation for a user to do EVERYTHING a regular admin could do without making him admin, and without giving him delegation for this particular OU... The admin should have freedom on anything except this ou. – user57657 Oct 25 '10 at 12:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.