In a Windows 2008r2 domain and forest functional level, I'm trying to delegate users account administration and 'password reset / force change' to a specific group of users in my active directory, BUT I don't want to grant them the permission to delete users accounts. Is there a way to accomplish this task?
Please note: I've tried many ways... Used the delegate control wizard choosing the delegate common tasks 'create, change, delete users accounts' and then denying the 'delete' and 'delete subtree' permissions; creating a custom task to only allow to create user account objects... But none of the approaches has worked. (I get the account created but error messages that state that I have insufficient rights to create the account so it would be created and then disabled...)