Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

My question is rather simple: How can I assign the right to a Windows Server user to create/manage Active Directory Users?

I am using Windows Server 2008 R2.

Thanks for your help!

PS: I moved this question from stackoverflow to serverfault: http://stackoverflow.com/posts/7429832

share|improve this question
1  
here is a good link technet.microsoft.com/en-us/library/cc756087(WS.10).aspx – tony roth Sep 15 '11 at 11:55

1 Answer

up vote 5 down vote accepted

I assume you do not want to make them a Domain Admin. So the right way to do this is with the Delegation Wizard. Go to the OU where you want to delegate control (if you have no OUs or want to grant this right for the entire directory, go to the root of the tree).

When you get to the Tasks to Delegate pick at least Create, Delete and manage user accounts. Look at the list for other tasks. Click through to complete the wizard.

share|improve this answer
This is absolutely correct, but depending on the level of trust you have in said person you can also just place them in the pre-defined "Account Operators" group. – SpacemanSpiff Sep 15 '11 at 18:02
Good point. One can use Account Operators if you want to give someone global Acct Mgmt rights. If you need to restrict them to specific OUs, the Delegation wizard will would be necessary. – uSlackr Sep 15 '11 at 20:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.