1

We have a situation where we need to deny domain admins from resetting passwords of users in a specific OU...

This is not a regular request.. Any idea?

Improve this question

2 Answers 2

Reset to default
3

You can do this by enabling advanced settings, and then right clicking on the OU and going to properties then security then advanced and configure Domain Admins with a deny for the password reset option

Word of warning i would suggest not denying domain admins, if there is a group of people in the domain admin group who you dont wish to do this then add them to a group and deny that group access

Improve this answer
2
  • Will this work for sure? If i make this change but the user still has permission to create delete and delete users, won't he have the right to reset passwords anyway?
    – user57657
    Oct 20, 2010 at 9:46
  • no create and delete users are different than changing a password, although he could delete the user then recreate him with a new password - and one thing to remember a Deny ALWAYS overrides an Allow hence why I suggested making another group for the deny
    – trozz
    Oct 20, 2010 at 12:01
0

Pretty sure you can do this if you adjust delegation for this ou.

Improve this answer
1
  • That's the thing, we need to provive delegation for a user to do EVERYTHING a regular admin could do without making him admin, and without giving him delegation for this particular OU... The admin should have freedom on anything except this ou.
    – user57657
    Oct 25, 2010 at 12:12

You must log in to answer this question.