Home / server / Questions / 336723
Accepted
MadBoy
Asked: 2011-12-02 09:46:08 +0800 CST

Grant permission in Active Directory to add users / modify / changed password / add them to group them but not delete them

  • 772

I would like to add delegate user ability to:

  • add new users to container
  • change password
  • modify group membership
  • modify users properties (such as email / name etc)
  • move users between OU's

Basically user will be able to do most things with account besides deleting it. I tried using Delegation of Control Wizard but the common tasks are too wide (usually including Delete part) so I need to go into custom task to delegate.

This are the options that I selected:

  • Only the following objects in the folder (User objects)

But the last permissions page is very wide and I wouldn't like to give user too much power. Can anyone share which options are necessary for the specified question? And as an extension to this write what each option means and what power it assigns?

active-directory permissions windows-server-2008-r2

2 Answers

  1. Best Answer

    To delegate permission for a domain user to:

    • add new users to container
    • change password
    • modify group membership
    • modify users properties (such as email / name etc)
    • move users between OU's

    I had to create 2 groups as Delegation Wizard wouldn't let me specify what to choose on each User object when I choose more then User object. So I decided to create 2 groups. One for user management and one for group management.

    First one required this steps:

    • Right click on container and choose Delegate Control
    • When Delegation Wizard opens up click Next
    • On another page choose group you want to give permissions to and press Next
    • On next page Create a custom task to delegate and choose Next
    • Choose Only the following objects in the folder and go to the bottom of the list and choose User objects. Choosing anything more then just one entry will not give you possibility of granular choice of properties to change.
    • Make sure to have Create selected objects in this folder checked and press Next

    • Choose:

      • Read All Properties
      • Write All Properties
      • Read and write general information
      • Read and write logon information
      • Read and write phone and mail options
      • Read and write web information
      • Read and write Terminal Server license server
      • Read and write remote access information
      • Change password
      • Reset password

    This allows to create user and enable / disable user but not delete it. At this moment user isn't able to change group membership as this has to be done differently.

    • 5

  2. You should take a look at the available ACEs on the user objects and delegate what you need, minus the Delete ACE.

    Although, it is still better practice to only give these types of rights to people you can trust to not delete your objects. There certainly will be accidents, but as I mentioned before, there are backups and other ways (prevent accidental deletion, AD recycle bin) to recover from those.

    • 0