Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are a very small company, and for some time I've been the only guy managing our domain/Active Directory. I'm NOT a sys admin, I'm a software dev, but I've done the best I could for them.

We're at the place now where we have a Jr IT Associate on board, and I'd like to hand off some of the Active Directory tasks to him, but don't want him to have 'God' permissions. He shouldn't have permissions to create/delete/edit DOMAIN ADMIN level accounts, but I'd like him to be able to create/delete/edit DOMAIN USER level accounts.

Is this doable?

Please let me know if I can help make the question clearer.

share|improve this question

migrated from Dec 28 '12 at 15:50

This question came from our site for computer enthusiasts and power users.

up vote 6 down vote accepted

First, create a security group called "Account Creators" or something like that.

In the ADUC console, right click on the OU that you want the user to be able to create accounts in. Click Delegate Permissions. There's is a pre-defined role for creating/deleting accounts. Select it and choose to delegate it to the group that you just made. Then, add whatever users you'd like to it.

share|improve this answer
There's also already an Account Operators group with the ability to manage other user accounts that are not also account operators or higher. – Ryan Ries Dec 28 '12 at 15:53
If one wanted more fine-grained permissions, it'd also be an idea to do this with the NTFS permissions on the object in AD and select exactly the operations said group should have access to. – Thor Dec 28 '12 at 15:57
@RyanRies But then people end up scratching their head when the AdminSDHolder kicks in and some accounts aren't respecting a different delegation 6 months down the line :) – MDMarra Dec 28 '12 at 16:03
Domain Users and Domain Admins are groups. This process has nothing to do with them. You delegate permission based on OU. Once the account is created, the JrltGuy shouldn't have any permission to add people to the privileged Domain Admin group unless you specifically delegate the ability for him to also add users to groups. By default, all new user accounts are members of the Domain Users group. Other than that, they will not be a member of anything. – MDMarra Dec 28 '12 at 16:14
An OU is just the "folder" looking thing in the ADUC console. It's a container for other objects. But yeah, it's definitely a good idea to do some basic reading before you start delegating, sometimes it's a lot easier to just get it right the first time than to try and undo something and re-do it. – MDMarra Dec 28 '12 at 16:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.