Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to get a junior team mate setup with rights on AD to create accounts, change passwords and create emails on exchange. What would be the best way to do this?

I tried half assing a delegation but I am not sure how to do it, so I stopped and backed out.

Can someone point me to an answer if they know the best way.


share|improve this question
  1. Survey the different collections of management tasks you need in AD.
  2. Create AD Security groups to represent these tasks.
  3. Delegate permissions, on OUs, to these groups based on role requirements.
  4. Populate groups with users that will perform management tasks.

In our K12 domain, we've delegated out separate groups for managing staff user accounts, student user accounts, building computers and multiple server management groups.

share|improve this answer
+1 - You said the magic words re: using groups. – Evan Anderson Dec 8 '09 at 20:20

You're on the right track. Right click the domain, container, or OU where you want to give the junior admin delegated rights and select Delegate Control, click Next, add the user and click OK, click Next, select the first three checkboxes, click Next, then click Finish. The junior admin will now be able to create and manage user accounts, reset passwords, and read all user account information. You can get as granular with Delegated Control as you want or need but this should at least get you what you need for the time being.

share|improve this answer
I'd give you a +1, but I have one beef. Never, ever, ever, ever, ever, ever, ever name individual users in permissin delegations. Create a group for the purposes of the delgation, name the group in the delegation, and put the appropriate user in the group. All permissions should be assigned to groups for very nearly any kind of resource. (User home directories are the only exception in my world...) Using groups lets you easily replicate permissions for new users / turnover / etc. – Evan Anderson Dec 8 '09 at 20:19
@Evan: There are no absolutes in life or IT. You're right though, I should have recommended using a group. – joeqwerty Dec 8 '09 at 20:51

The definitive guide on this topic is available from Microsoft here:

Best Practices for Delegating Active Directory Administration

share|improve this answer

There's an article on this issue:

Active Directory Delegation. It explains a scope of activity of a third party solution, I should admit.

Thank you.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.