Regarding AD accounts, I believe(correct me if im wrong) it is possible to create an account which has permission to create, modify and disable/enable acconts and reset passwords without that specific account being able to logon to the domain controller itself.
I just want to ask which permissions is needed for that? basically I want to have the server only be accessed by certain people but some certain people should be able to create and modify accounts. Am i in the right direction of thinking its possible with account permissions? or is it something with the GPO of the server itself that I have to configure? thanks.
