0

I want to give a normal "Domain Users", permission to reset the password of users in the Domain Admins Group.

So I created an OU and moved all the user account targets into it.

Then I used "Delegate Control" to give the password reset rights to the normal domain user.

After doing an 'Enable Inheritance' on all the User Accounts it worked.

But shortly after that, the inheritance on the Domain Admins Users became disabled. And it stopped working.

I believe it's AdminSDHolder and Protected Groups is doing it.

I cannot remove users from Domain Admins Group, is there another approach to solving this?

thanks,

1
  • 1
    Whatever old is this, the idea of giving any domain user the ability to reset domain admin password is certainly won't hold any reasoning. Nov 26, 2021 at 6:41

2 Answers 2

1

I don't even want to know why you want to do this. It's such a terrible idea, it doesn't even matter.

You're correct that AdminSDHolder is resetting the permissions on the protected DA accounts. This Technet article explains more in depth.

https://technet.microsoft.com/en-us/library/2009.09.sdadminholder.aspx

It also explains that you can use the dsHeuristics attribute on the forest's Directory Service object to set a bit flag that determines which groups are protected. But (thankfully), Domain Admins isn't one of the groups you can exclude.

*Edit

I forgot that it's also possible to modify the permissions on the actual AdminSDHolder object. The permissions on that object are what get stamped onto the protected users. So if you added your Domain Users permissions on it, they would get stamped onto the DAs.

But really, why bother? At the point any users in the domain can reset the password of any DA user, why not just make all users DA? Hell, why bother with users at all? Just make the actual domain administrator password "12345" and call it a day.

4
  • So the only way to give a Domain User permission to reset the password of a Domain Admin, is to make that user a Domain Admin? Is there no other approach to this? Many thanks. Jul 13, 2017 at 17:16
  • Hi, Ryan, I tried your great suggestion, and did a Delegate Control against the AdminSDHolder special folder, and configured exactly the same Policy for my Domain User to change other User Passwords, that normally works. But user is failing to reset passwords, and when I open the Advanced properties of the Target Domain User, my user is not listed. But it is listed as having 'special permissions' on the AdminSDHolder folder. Is there something I've missed? Its a 2012 DC , many thanks Jul 13, 2017 at 19:49
  • The SDProp process that does the permissions stamping only runs once per hour by default. It may not have applied yet. Jul 13, 2017 at 21:21
  • Yup. an hour later the policy arrived at the User object. I opened it and confirmed my user had Change Password, Reset Password, Read pwdLastSet and Write pwdLastSet on the object. But the user still fails to reset the password ..? Jul 13, 2017 at 22:48
0

I failed to use Delegation for reasons above. Here is my workaround:

Run dsa.msc Active Directory Users and Computers.

  1. Enable View->Advanced Features
  2. Locate the TARGET Domain User Account object
  3. Right-Click the object and select Properties
  4. Select the Security Tab.
  5. Click Add at the top box and add WORKER Account and Save
  6. Click Apply
  7. Click Advanced at the bottom, the Advanced Security Settings for the account appears.
  8. Double-Click WORKER Account entry, the Permissions Edit for the account appears.
  9. Select : Change Password Reset Password Read pwdLastSet Write pwdLastSet

  10. Click OK and close all windows

Not the answer you're looking for? Browse other questions tagged .