I am running Server 2008 R2 in an Active Directory Domain Environment.

I have created a group in Active Directory and I have delegated management authority to that group to a user.

I want this user to be able to add and remove accounts as needed from that group so that they are exercising some measurement of control without giving them other authority.

When I have the user attempt to access the Active Directory Users & Computers Console it prompts them for Administrator credentials. They are using Remote Desktop to access the server, because they do not have Windows 7, and firewall rules prevent using the Remote Management Kit.

I do not want to provide them with any level of Administrative rights except the minimum required for them to add/remove users from this group.

There are two servers that 'talk' to each other in this isolated environment, a domain controller and a member server, both are only reachable through RDP.

Any suggestions?


Per the comments on this question, have you tried perhaps adding the user to the "Power Users" group?

Also, what happens if they just say "No" at the UAC prompt? I would expect that the MMC opens properly still; is that not the case? If it opens still, you could use TweakUAC to disable the prompt.

My guess is that running ADUC is twigging a built-in automatic privilege elevation rule, either from that snap-in or from mmc.exe as a whole. If neither of the above suggestions works, I'd try variations on running the tool: running the snap-in .msc file directly, copying the .msc somewhere and then running that, etc.


Thank you for the above suggestions, this is how I ended up solving the problem.

In order to even open the Active Directory Users and Computers MMC console in Windows Server 2008 R2 the user needs at minimum to be part of the 'account operators' permissions group.

So, I placed the user in a group and placed that group in the account operators group. This allowed him to open the console.

In order to restrict him to only manipulate the one group that I needed I went in and specifically added the 'Deny-Read' permission to every other OU in the domain to the group the user resides in. So when the user opens the ADU&C console, the only thing he sees is the one OU and the one Group that he actually has management control over.

Not exactly the most elegent solution, but it worked.


You could add the managedby property to a security group, the user account who is that has the permissions to add/remove users from that certain group.


Add the user in Allow logon locally in Default domain controller policy.

Group Policy Management --> Default Domain Controller policy

Edit Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/User Rights Assignment/Allow Logon locally

After doing gpupdate in command prompt, Login in DC with that user account and give the user credentials. Now your requirement will be fulfilled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.