Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

No other permissions, just the ability to reset AD passwords?


share|improve this question
Yes. I'm lazy, so here's an article, someone can write a more complete Answer.… – Chris S Feb 10 '12 at 17:54
They wouldn't be an administrator then, would they?...just delegate the role to a user in AD? – Bart Silverstrim Feb 10 '12 at 17:57
HAHA I'm so lazy I guessed at the delegation part without reading your linked article first, @chriss – Bart Silverstrim Feb 10 '12 at 17:58
Thanks Chris!!! – slashp Feb 10 '12 at 18:01
up vote 7 down vote accepted

No. There is no way to create a Domain Administrator account that can only reset passwords. If a user account is a Domain Administrator, they have unrestricted access to the domain.

What you can do is create a group, call it something like Password Resetters, open ADUC, right click on the OU that you want to delegate, select Delegate Control and follow the prompts to delegate password reset to the group that you created. It's a common task, so there is a predefined template for it in the wizard.

share|improve this answer

The default group "Account Operators" can reset passwords on any account (except those of Domain Admins, and other Account Operators). It does however also allow modification of group membership, other account attributes, etc. If you don't mind that, use Account Operators. Otherwise, you have to do delegation with custom ACLs.

share|improve this answer
Microsoft now recommends that You don't add users to Account Operators and that you just delegate control. Adding someone to Account Operators or any other protected group changes their AdminCount attribute, which makes them effected by the AdminSDHolder process. This means that management of these accounts cannot be delegated. – MDMarra May 30 '12 at 10:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.