I am in the process of delegating some Active Directory tasks to a group of users. These users do not have domain administration rights and will only perform tasks such as creating/disabling accounts in a single OU. I have two questions:
a) In order for the users to be able to perform these actions from their workstations, is there any other method other than installing the Remote Server and Administration Tools? Could I install only the 'Active Directory Users and Computers' snap-in somehow?
b) Despite creating a custom AD snap-in using mmc.exe so the single OU to be managed is at the root, I was surprised to see that users still had read-access to the whole AD domain structure. Is this by design or have my permissions gone awry somewhere?
Many thanks!