Accounts operators have more permissions that just resetting passwords.
Here is the information from MS documentation.
Account Operators
Members of this group can create, modify, and delete accounts for users,
groups, and computers located in the Users or Computers containers and
organizational units in the domain, except the Domain Controllers
organizational unit. Members of this group do not have permission to
modify the Administrators or the Domain Admins groups, nor do they have
permission to modify the accounts for members of those groups. Members
of this group can log on locally to domain controllers in the domain and
shut them down. Because this group has significant power in the domain,
add users with caution.
Source:
http://technet2.microsoft.com/WindowsServer/en/library/1631acad-ef34-4f7
7-9c2e-94a62f8846cf1033.mspx?mfr=true
Happy holidays
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Michael Miller
Sent: Friday, December 22, 2006 7:39 AM
To: ActiveDir@mail.activedir.org
Subject: Re: [ActiveDir] Delegate Password Resets
I put the user accounts of the helpdesk personnel in the built in group,
Account Operators. This is precisely why I think that group exists.
-mjm
Salandra, Justin A. wrote:
>
> I wanted to find out from all of you what ways you have delegated
> password reset functions to your helpdesks. We have a product that
> does this but it is continually having problems and want to know if
> there are nay other ways.
>
>
>
> Justin A. Salandra
>
> MCSE Windows 2000 and 2003
>
> Network and Technology Services Manager
>
> Catholic Health Care System
>
> 646.505.3681
>
> cell 917.455.0110
>
> [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>
>
>
>
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir@mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir@mail.activedir.org/
