Yes that's more or less what I was describing. Thanks, Brian Desmond [email protected]
c - 312.731.3132 From: Christopher Bodnar [mailto:[email protected]] Sent: Monday, October 05, 2009 11:04 AM To: NT System Admin Issues Subject: RE: Delegate permission: Reset Domain Admin passwords Take a look at this: http://support.microsoft.com/?id=817433 Go down to the Workaround section and look at Method 3. The way I read that, is if I add my HelpDesk group in there, and only give them reset password permissions, it will do what I'm looking for. Is that how you guys read it? Thanks Chris Bodnar, MCSE Sr. Systems Engineer Infrastructure Service Delivery Distributed Systems Service Delivery - Intel Services Guardian Life Insurance Company of America Email: [email protected]<mailto:[email protected]> Phone: 610-807-6459 Fax: 610-807-6003 ________________________________ From: [email protected] [mailto:[email protected]] Sent: Monday, October 05, 2009 11:57 AM To: NT System Admin Issues Subject: RE: Delegate permission: Reset Domain Admin passwords AdminSdHolder circumvents this as it removes inheritance from the affected accounts. Thanks, Brian Desmond [email protected]<mailto:[email protected]> c - 312.731.3132 Active Directory, 4th Ed - http://www.briandesmond.com/ad4/ Microsoft MVP - https://mvp.support.microsoft.com/profile/Brian From: KenM [mailto:[email protected]] Sent: Monday, October 05, 2009 10:48 AM To: NT System Admin Issues Subject: Re: Delegate permission: Reset Domain Admin passwords Are all of you DA accounts in the same OU? If so just delegate the right to reset passwords for the helpdesk on the OU. On Mon, Oct 5, 2009 at 11:26 AM, Christopher Bodnar <[email protected]<mailto:[email protected]>> wrote: We have a requirement that our helpdesk be delegated the right to reset passwords for Domain Admin accounts, but need to limit their access. I don't want to add them to Domain Admins. I know that the Domain Admins is a protected group and I'm aware of the function of the AdminSDHolder object. I could remove Domain Admins from that but I don't think that is the way to go with this. I just want to delegate that permission to a group. Anyone have to do this yet? Chris Bodnar, MCSE Sr. Systems Engineer Infrastructure Service Delivery Distributed Systems Service Delivery - Intel Services Guardian Life Insurance Company of America Email: [email protected]<mailto:[email protected]> Phone: 610-807-6459 Fax: 610-807-6003 ________________________________ This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you. ________________________________ This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
