up vote 1 down vote favorite
share [g+] share [fb]

We have a situation where we need to deny domain admins from resetting passwords of users in a specific OU...

This is not a regular request.. Any idea?

link|improve this question
feedback

2 Answers

up vote 3 down vote

You can do this by enabling advanced settings, and then right clicking on the OU and going to properties then security then advanced and configure Domain Admins with a deny for the password reset option

Word of warning i would suggest not denying domain admins, if there is a group of people in the domain admin group who you dont wish to do this then add them to a group and deny that group access

link|improve this answer
Will this work for sure? If i make this change but the user still has permission to create delete and delete users, won't he have the right to reset passwords anyway? – user57657 Oct 20 '10 at 9:46
no create and delete users are different than changing a password, although he could delete the user then recreate him with a new password - and one thing to remember a Deny ALWAYS overrides an Allow hence why I suggested making another group for the deny – Trozz Oct 20 '10 at 12:01
feedback
up vote 0 down vote

Pretty sure you can do this if you adjust delegation for this ou.

link|improve this answer
That's the thing, we need to provive delegation for a user to do EVERYTHING a regular admin could do without making him admin, and without giving him delegation for this particular OU... The admin should have freedom on anything except this ou. – user57657 Oct 25 '10 at 12:12
feedback

Your Answer

 
or
required, but never shown
discard