Rights to edit user accounts

[Guest]

Archived from groups: microsoft.public.windowsnt.domain (More info?)

Hi,
I am trying to work out the minimum rights that a user
account can have to be able to edit all user accounts in a
Windows NT domain. Currently the account I am concerned
about is in the Account Operators group, but this doesn't
give it rights to edit user accounts that are in admin
type groups (Q245174). From what I can tell, there is no
choice but to put the account in question into the
administrators group. Is that correct?
Thanks for any suggestions,
Chris

 

[Guest]

Archived from groups: microsoft.public.windowsnt.domain (More info?)

Yes...

If you are allowing someone to edit the accounts of an administrator, then
they would be able to promote themselves or reset the password and use the
other account for themselves. That's the reasoning behind the way it is.


"Chris Hill" <anonymous@discussions.microsoft.com> wrote in message
news:d04701c439a7$7f9f1430$a101280a@phx.gbl...
> Hi,
> I am trying to work out the minimum rights that a user
> account can have to be able to edit all user accounts in a
> Windows NT domain. Currently the account I am concerned
> about is in the Account Operators group, but this doesn't
> give it rights to edit user accounts that are in admin
> type groups (Q245174). From what I can tell, there is no
> choice but to put the account in question into the
> administrators group. Is that correct?
> Thanks for any suggestions,
> Chris