I am trying to delegate permission to my helpdesk technicians to allow them to reset user passwords in our Win2008 R2 AD. I've used the delegate control wizard in ADUC and am delegating the predefined permission "Reset user passwords and force password change an next logon" to a 'Helpdesk' AD group, which all of our helpdesk techs are members of. I'm delegating this permission on the default Users container in AD which all of our end user accounts are under.

I've manually connected to each DC using ADUC and run the delegation wizard to be doubly sure all DCs know about the delegation.

I have created a test AD user account in the default Users container. I set up a test Win7 virtual machine and joined it to the domain. Then I logged into this VM as one of the helpdesk users and tried to reset the test AD account's password from the command line:

net user testuser Somepassword1 /domain

This is the response I receive:

The request will be processed at a domain controller for domain mycompany.local.

System error 5 has occurred.

Access is denied.

The same command works fine for me if I run it on my computer while logged in as my domain admin account.

I checked a few other similar questions and it was suggested to examine the effective permissions, but I'm not sure how to go about doing so.

| improve this question | | | | |
  • I've manually connected to each DC using ADUC and run the delegation wizard to be doubly sure all DCs know about the delegation. - Don't do this. Make your change on a single DC. Replication will take care of the rest. The fact that you did this tells me that maybe you're not the right person to be managing AD. – joeqwerty Apr 7 '16 at 20:45
  • Hi joeqwerty. I did this as a troubleshooting mechanism when the procedure did not work as expected. Unless you can provide some reason why this procedure could cause problems, I'd say you might not be the right person to answer AD questions. – vrtigo1 Apr 8 '16 at 14:48

I would try it with Powershell rather than the net command, you will need to install the admin pack (RSAT) in your windows 7 VM and then in powershell

import-module activedirectory

Set-ADAccountPassword testuser -NewPassword mypassword1 -Verbose
| improve this answer | | | | |
  • Hi Rob-d. Thanks for your suggestion. Changing the password this way works. I was trying to avoid requiring the helpdesk staff to install RSAT, but apparently changing the password using the native net command line utility will not work as it requires more than the permissions the delegation wizard provides. – vrtigo1 Apr 8 '16 at 15:31
  • you could always just install the powershell module for AD without RSAT – Sum1sAdmin Apr 8 '16 at 15:32
  • Hi Rob-d. Thanks for the suggestion, but I think the powershell module for AD is a component of RSAT. Either way, I was just trying to save them some work but requiring them to install RSAT is no skin off my back so that's what I communicated. Thanks again for your help! – vrtigo1 Apr 9 '16 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.