Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a situation where we need to deny domain admins from resetting passwords of users in a specific OU...

This is not a regular request.. Any idea?

share|improve this question

You can do this by enabling advanced settings, and then right clicking on the OU and going to properties then security then advanced and configure Domain Admins with a deny for the password reset option

Word of warning i would suggest not denying domain admins, if there is a group of people in the domain admin group who you dont wish to do this then add them to a group and deny that group access

share|improve this answer
Will this work for sure? If i make this change but the user still has permission to create delete and delete users, won't he have the right to reset passwords anyway? – user57657 Oct 20 '10 at 9:46
no create and delete users are different than changing a password, although he could delete the user then recreate him with a new password - and one thing to remember a Deny ALWAYS overrides an Allow hence why I suggested making another group for the deny – Trozz Oct 20 '10 at 12:01

Pretty sure you can do this if you adjust delegation for this ou.

share|improve this answer
That's the thing, we need to provive delegation for a user to do EVERYTHING a regular admin could do without making him admin, and without giving him delegation for this particular OU... The admin should have freedom on anything except this ou. – user57657 Oct 25 '10 at 12:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.