I wanted to create a new domain with a bit flat approach. Rather than having multiple OU's with sub-ou's and sub ou's depending on project, user location I wanted to create groups and put users in groups.

For example all users would be put in some OU=Users in DC=DOM,CN=LOC, and then multiple groups would be created:

  • GRP-LOC-Warsaw
  • GRP-LOC-NewYork

However I end up thinking how to delegate permissions to those groups so that I can have manager reset passwords (or do other actions in Warsaw).

As it seems delegation is done per OU basis only I am still stuck to OU's if I want to have granular control (per project, location, sub location etc)? Or someone has done it and I'm simply missing something?


Password management can only be delegated to OU's because ACL entries on OU's are passed by inheritance to the user object. Groups do not change the ACL's on the users they contain.

You should re-think your plan to flatten your AD.

|improve this answer|||||
  • As I thought. Thank for confirming this. – MadBoy Oct 21 '16 at 13:09

I advise the following:

1: Construct a program that runs as a Windows Service that can reset passwords and performs the appropriate group and calling user check. The program can get the calling user by appropriate use of named pipes. See https://stackoverflow.com/questions/12026971/get-client-user-token-from-named-pipe.

2: Deploy your program as runas with a domain admin service account.

Longneck's answer is correct as far as stock Windows is concerned.

|improve this answer|||||
  • Resetting passwords was just simple idea. But the concept is general which means any delegation that would need to be achieved would require custom software. Which at later date poses a risk where one account gets all the permissions. – MadBoy Oct 21 '16 at 15:44
  • @MadBoy: I've seen enough cases where it would not expand beyond reset passwords in the foreseeable future. – joshudson Oct 21 '16 at 15:55
  • That may be, but my dream concept went with fire ;-) – MadBoy Oct 21 '16 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.