Hi To complete Al statements, 1) Check if the help desk person has all the required permissions on that user by either uses dsacls(dsacls <objectDN>),acldiag (acldiag <objectDN> /geteffective:<userorgroup>) or the "effective permission" on the security tab of that user. 2) Check if the user belongs to protected groups. 3) Check if the helpd desk person has explicite denied permission, or belongs to a group that have denied ace.to this user object, you will see this by dsacls or effective permission tab. Yann On 1/5/06, Aguilar, Louis <[EMAIL PROTECTED]> wrote:
We hired a new help desk person this month. I'm trying to give her the
ability to administer certain request (unlock user accounts, reset
passwords.....). I've tried accomplish by following:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/ctrlwiz.mspx
Everything seems to work fine on new accounts, but she cannot
administer anything on existing/old accounts. She keeps getting access denied
Thanks for your time in advance
Louis
NOTICE OF CONFIDENTIALITY
This message, including attachments, is from Family Health Partners.
This message contains information that may be confidential and protected by
HIPAA Privacy Regulations. If you are not the intended recipient, promptly
delete this message and notify the sender of the delivery error by return
e-mail or call the FHP Compliance Department at 816-234-3946. You may not
forward, print, copy, distribute or use the information in this message if you
are not the intended recipient.
________________________________
<<winmail.dat>>
