Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm responsible by Active Directory (AD) where I'm working, and I'm trying to figure out, how can I allow, that sector managers of the company, may add and delete users from its departments respective, without the need that anyone of them be a domain administrator. So, please any help?

share|improve this question

migrated from Jan 10 '12 at 10:04

This question came from our site for professional and enthusiast programmers.

You're looking for the Delegation of Control functionality in Active Directory Users and Computers. I don't prefer @Harry Johnston's answer because, while technically valid, you really should use the "Wizard" so that you don't have to muck about with the specific entries in the access control lists (ACLs) you're trying to manage.

Assume a Directory that looks as follows:

   |-- [OU]  Sales
   |     |
   |   [user]  Bob, Sales Manager
   |-- [OU]  Service
   |     |
   |   [user]  Jane, Service Manager
   |-- [OU]  Security Groups
   |     |
   |     |-- [OU]  Groups Managed by Delegates
   |     |     |
   |     |   [group]  Sales Gerbils
   |     |     |
   |     |   [group]  Service Technicians
   |     | 
   |   [group]  Delegated Sales Managers
   |     |
   |   [group]  Delegated Service Managers
   |     |
  ...   ...

Assuming you'd like Bob to be able to create new Sales users and Jane to be able to create new Service users you'd:

  • Make Bob a member of the "Delegated Sales Managers" group
  • Make Jane a member of the "Delegated Service Managers" group
  • Use the "Delegation of Control" wizard at the "Sales" OU to grant "Create, delete, and manage user accounts" permissions to the "Delegated Sales Managers" group
  • Use the "Delegation of Control" wizard at the "Service" OU to grant "Create, delete, and manage user accounts" permissions to the "Delegated Service Managers" group

This would allow Bob and Jane to create user accounts in the appropriate OUs, but it wouldn't allow them to make the users members of groups. By putting groups that Bob and Jane are permitted to manage the membership for under the "Groups Managed by Delegates" OU and using the Delegation of Control wizard to grant "Delegated Sales Managers" and "Delegated Service Managers" the "Modify the membership of a group" right on the "Groups Managed by Delegates" OU both Bob and Jane would be permitted to add users (users they create or other users that already exist in the Directory!) to the groups in and below this OU.

If you wanted to stop Bob from adding users to the "Service Technicians" group and Jane to the "Sales Gerbils" group you could create sub-OUs under the "Groups Managed by Delegates" OU and delegate control there (a "Sales Groups" OU and a "Service Groups" OU, for example).

The nice thing is that you can create a test OU in your Directory, create some test accounts and groups, and play around with this functionality without impacting the rest of your Directory. Give it a shot and test out your solution before you roll it out to users.

share|improve this answer
Please tell me you have a tool to make that ASCII tree and you didn't do it by hand. – MDMarra Jan 10 '12 at 14:57
@MDMarra: Of course I have a tool! It ships stock with Windows... %SystemRoot%\system32\notepad.exe. – Evan Anderson Jan 10 '12 at 15:05
You're absolutely right. I've removed my answer. – Harry Johnston Jan 11 '12 at 0:59
@HarryJohnston: Zow! I certainly didn't mean to influence you to remove your answer. It had more upvotes than mine and clearly has merit, though it's not necessarily the way I'd recommend for someone unfamiliar with Active Directory. You might consider undeleting it and editing to add a caveat re: "this is the way that an admin familiar with modifying ACLs might do it". – Evan Anderson Jan 11 '12 at 15:49
@EvanAnderson: not to worry, I've always wanted a good excuse to earn the "disciplined" badge. :-) – Harry Johnston Jan 12 '12 at 1:30

Assuming that you are in Windows Server 2008, Go to ADUC, enable the advanced mode and there you will see a Console Tree: under that there is a category called Builtin and over there you will find 'Account Operators' You have to put your managers list in another group called. 'Account Operators' which allows them to administer the domain user and group accounts. Hope this helps.

share|improve this answer
Using builtin groups such as these is a really bad practice. These groups have a ton of extra access that's not really evident, and they lead to accounts being protected by adminSDHolder which is usually not desirable. – Brian Desmond Jan 10 '12 at 4:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.