We are a very small company, and for some time I've been the only guy managing our domain/Active Directory. I'm NOT a sys admin, I'm a software dev, but I've done the best I could for them.
We're at the place now where we have a Jr IT Associate on board, and I'd like to hand off some of the Active Directory tasks to him, but don't want him to have 'God' permissions. He shouldn't have permissions to create/delete/edit DOMAIN ADMIN level accounts, but I'd like him to be able to create/delete/edit DOMAIN USER level accounts.
Is this doable?
Please let me know if I can help make the question clearer.