How to assign permissions to a domanin user such that he can only change active directry users password & he can be able to join or remove Client computers to the domain.

He should have admin rights on all (Client computers)


Question 1:

  • Log on to Windows Server as a domain administrator and open Server Manager from the icon on the desktop Taskbar or from the Start screen.
  • Select Active Directory Users and Computers (ADUC) from the Tools menu.
  • In the left pane of ADUC, expand your domain, right-click the Users container (or the OU for which you want to delegate permissions) and select Delegate Control from the menu.
  • Click Next on the welcome screen.
  • On the Users or Groups screen, click Add.
  • In the Select Users, Computers, or Groups dialog, type the name of the AD group you want to give permission to reset user account passwords and click OK. In this example, I already have an AD group called HelpDesk that I’m going to use.
  • On the Users or Groups screen, click Next.
  • On the Tasks to Delegate screen, check Reset user passwords and force password change at next logon and click Next.

Question 2 :

Delegate rights using Active Directory Users and Computers:

  1. Open the Active Directory Users and Computers


  1. Right-click the container under which you want the computers added, and press Delegate Control.

  2. Press Next.

  3. Press Add.

  4. After adding all the users and/or groups, press Next.

  5. Select Create custom task to delegate and press Next.

  6. Select Only the following objects in the folder, check Computer objects, check the Create selected objects in this folder box, and press Next.

  7. Check the Create all child object box and press Next.

  8. Press Finish.

Question 3

Start by creating a new GPO named Restricted Groups: GROUP NAME (ex: Restricted Groups: Local Administrators). Edit the GPO and navigate to Computer Configuration/Policies/Windows Settings/Security Settings/Restricted Groups. Under Group Name, right click and select Add Group.

| improve this answer | |
  • Unable to login remotely to dc after even assigning RDP permissions. – Ranveer Mar 15 '16 at 13:26
  • 1
    @Ranveer You install the RSAT tool to the user who want to manage the user. To RDP to a DC you need more right and it's not a good practice (microsoft.com/en-ca/download/details.aspx?id=7887) – yagmoth555 Mar 15 '16 at 13:48
  • 1
    Thanx for your quick responce – Ranveer Mar 15 '16 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.