Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to create an user of our domain controller (Windows Server 2008) so that he can create and delete any domain users other that those granted administrator rights, how to do that?

share|improve this question
1  
Can you clarify "those granted administrator rights" - do you mean the Domain Admins group? –  Shane Madden Dec 5 '12 at 2:06
    
Yes, I mean the domain admins group. At the moment, I am the only one user granted permission to create/delete users. I would like to give the same rights to another user, but I don't want him to be able to delete me. –  Chris Huong Dec 5 '12 at 2:25

1 Answer 1

You put all of your administrative users in one OU, then put all others in another OU or tree of OUs. Then, delegate permission to the user/group to create/delete objects in the non-administrative OU by right clicking on the OU and selecting "delegate permissions"

share|improve this answer
2  
Yep, simple as this. Please though, delegate the permissions to groups, not individual users. In fact, if you can, create groups dedicated for this specific admin delegation, then populate this new group with the required admin users. You'll be happy later when you have to add/remove users from this admin delegation right. –  jscott Dec 5 '12 at 2:13
    
AdminSDHolder will also contribute to keeping users with delegated rights from touching users who hold an administrative group membership in the domain. –  Shane Madden Dec 5 '12 at 2:50
    
Very true, but AdminSDHolder only protects members of privileged groups. If the OP doesn't want users delegated this way to be able to delete other users delegated this way, then they should be separated by OU. –  MDMarra Dec 5 '12 at 2:52
    
Can someone explain to me what does it mean by "delegate delegate permission to the user/group"? –  Chris Huong Dec 5 '12 at 6:49
    

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.