I want to give a normal "Domain Users", permission to reset the password of users in the Domain Admins Group.
So I created an OU and moved all the user account targets into it.
Then I used "Delegate Control" to give the password reset rights to the normal domain user.
After doing an 'Enable Inheritance' on all the User Accounts it worked.
But shortly after that, the inheritance on the Domain Admins Users became disabled. And it stopped working.
I believe it's AdminSDHolder and Protected Groups is doing it.
I cannot remove users from Domain Admins Group, is there another approach to solving this?
thanks,