Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My question is rather simple: How can I assign the right to a Windows Server user to create/manage Active Directory Users?

I am using Windows Server 2008 R2.

Thanks for your help!

PS: I moved this question from stackoverflow to serverfault:

share|improve this question
here is a good link – tony roth Sep 15 '11 at 11:55
up vote 5 down vote accepted

I assume you do not want to make them a Domain Admin. So the right way to do this is with the Delegation Wizard. Go to the OU where you want to delegate control (if you have no OUs or want to grant this right for the entire directory, go to the root of the tree).

When you get to the Tasks to Delegate pick at least Create, Delete and manage user accounts. Look at the list for other tasks. Click through to complete the wizard.

share|improve this answer
This is absolutely correct, but depending on the level of trust you have in said person you can also just place them in the pre-defined "Account Operators" group. – SpacemanSpiff Sep 15 '11 at 18:02
Good point. One can use Account Operators if you want to give someone global Acct Mgmt rights. If you need to restrict them to specific OUs, the Delegation wizard will would be necessary. – uSlackr Sep 15 '11 at 20:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.