In a Windows 2008r2 domain and forest functional level, I'm trying to delegate users account administration and 'password reset / force change' to a specific group of users in my active directory, BUT I don't want to grant them the permission to delete users accounts. Is there a way to accomplish this task?

Please note: I've tried many ways... Used the delegate control wizard choosing the delegate common tasks 'create, change, delete users accounts' and then denying the 'delete' and 'delete subtree' permissions; creating a custom task to only allow to create user account objects... But none of the approaches has worked. (I get the account created but error messages that state that I have insufficient rights to create the account so it would be created and then disabled...)

Any ideas?


I could say that I have found the answer in this other serverfault question. Sorry about the inconvenience and thanks for your help.

| improve this answer | |

You need to create a security group for this permission, then select the OU which you would like to delegate control of.

From there:

Select the Security Group and hit next.

Select Create a custom task to delegate, then hit next

Select the following permissions:

  • Create User Objects

  • Read All Properties

  • Write userPassword

This should give your users the sufficient privileges to create accounts, read their information and set their passwords.

If you want to allow these users to set any additional fields, simply select Allow on the Write permission for that field.

| improve this answer | |
  • Hi @teddftw, Thanks for your answer. I had previously made what you say. I created a group to delegate these tasks (called 'call_center'); added members to the group, and then run the delegation wizard on the testing 'OU'. The problem comes when I try to avoid user account deletion giving a deny entry in the 'testing ou' ACL delete and delete subtree. – DescOPS Nov 6 '19 at 11:09
  • @DescOPS - Have you right clicked on the OU > Properties > Security and denied Delete Object to the call_center group? – t3ddftw Nov 6 '19 at 18:35
  • Yes @t3ddftw. As stated in the question I tried that option with very bad results as the new users accounts couldn't be created correctly and they were created and then disabled. – DescOPS Nov 7 '19 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.