Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am running Server 2008 R2 in an Active Directory Domain Environment.

I have created a group in Active Directory and I have delegated management authority to that group to a user.

I want this user to be able to add and remove accounts as needed from that group so that they are exercising some measurement of control without giving them other authority.

When I have the user attempt to access the Active Directory Users & Computers Console it prompts them for Administrator credentials. They are using Remote Desktop to access the server, because they do not have Windows 7, and firewall rules prevent using the Remote Management Kit.

I do not want to provide them with any level of Administrative rights except the minimum required for them to add/remove users from this group.

There are two servers that 'talk' to each other in this isolated environment, a domain controller and a member server, both are only reachable through RDP.

Any suggestions?

share|improve this question

3 Answers 3

Per the comments on this question, have you tried perhaps adding the user to the "Power Users" group?

Also, what happens if they just say "No" at the UAC prompt? I would expect that the MMC opens properly still; is that not the case? If it opens still, you could use TweakUAC to disable the prompt.

My guess is that running ADUC is twigging a built-in automatic privilege elevation rule, either from that snap-in or from mmc.exe as a whole. If neither of the above suggestions works, I'd try variations on running the tool: running the snap-in .msc file directly, copying the .msc somewhere and then running that, etc.

share|improve this answer

Thank you for the above suggestions, this is how I ended up solving the problem.

In order to even open the Active Directory Users and Computers MMC console in Windows Server 2008 R2 the user needs at minimum to be part of the 'account operators' permissions group.

So, I placed the user in a group and placed that group in the account operators group. This allowed him to open the console.

In order to restrict him to only manipulate the one group that I needed I went in and specifically added the 'Deny-Read' permission to every other OU in the domain to the group the user resides in. So when the user opens the ADU&C console, the only thing he sees is the one OU and the one Group that he actually has management control over.

Not exactly the most elegent solution, but it worked.

share|improve this answer

You could add the managedby property to a security group, the user account who is that has the permissions to add/remove users from that certain group.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.