1

We have a situation where we need to deny domain admins from resetting passwords of users in a specific OU...

This is not a regular request.. Any idea?

3

You can do this by enabling advanced settings, and then right clicking on the OU and going to properties then security then advanced and configure Domain Admins with a deny for the password reset option

Word of warning i would suggest not denying domain admins, if there is a group of people in the domain admin group who you dont wish to do this then add them to a group and deny that group access

| improve this answer | |
  • Will this work for sure? If i make this change but the user still has permission to create delete and delete users, won't he have the right to reset passwords anyway? – user57657 Oct 20 '10 at 9:46
  • no create and delete users are different than changing a password, although he could delete the user then recreate him with a new password - and one thing to remember a Deny ALWAYS overrides an Allow hence why I suggested making another group for the deny – trozz Oct 20 '10 at 12:01
0

Pretty sure you can do this if you adjust delegation for this ou.

| improve this answer | |
  • That's the thing, we need to provive delegation for a user to do EVERYTHING a regular admin could do without making him admin, and without giving him delegation for this particular OU... The admin should have freedom on anything except this ou. – user57657 Oct 25 '10 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy