Regarding AD accounts, I believe(correct me if im wrong) it is possible to create an account which has permission to create, modify and disable/enable acconts and reset passwords without that specific account being able to logon to the domain controller itself.

I just want to ask which permissions is needed for that? basically I want to have the server only be accessed by certain people but some certain people should be able to create and modify accounts. Am i in the right direction of thinking its possible with account permissions? or is it something with the GPO of the server itself that I have to configure? thanks.

1 Answer 1


Look up "active directory delegation wizard". You can create an AD account and delegate these permissions. Google is your friend.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .