Limited Access to ADU&C for HR?

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hi All,

I would like to offload everyday management of security group & user
maintenance to a member of our HR team who was a network admin in a previous
life. This person would be allowed to use Active Directory Users & Computers
to add new users & change group memberships in the domain, as well as change
file & folder security in the HR file server. I would prefer not to make
them a domain admin obviously. . .

Any recommendations or caveats? Anyone else do this? What permissions do I
have to give this HR person to allow them to accomplish the above tasks?

TIA,
Rube

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hello Rube,
Take use of the Delegate of Control Wizard.

See the Step-by-Step Guide to Using the Delegation of Control Wizard
This guide shows how to delegate control of objects in an Active Directory
service container, using the Delegation of Control wizard in the Active
Directory Users and Computers snap-in.

http://www.microsoft.com/windows2000/techinfo/planning/activedirectory/delegsteps.asp


--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup
------------------------------------------------
http://www.chrisse.se - Active Directory Tips

"Rube" <dont@spam.me> skrev i meddelandet
news:%23DFlcQ91EHA.2012@TK2MSFTNGP15.phx.gbl...
> Hi All,
>
> I would like to offload everyday management of security group & user
> maintenance to a member of our HR team who was a network admin in a
> previous
> life. This person would be allowed to use Active Directory Users &
> Computers
> to add new users & change group memberships in the domain, as well as
> change
> file & folder security in the HR file server. I would prefer not to make
> them a domain admin obviously. . .
>
> Any recommendations or caveats? Anyone else do this? What permissions do I
> have to give this HR person to allow them to accomplish the above tasks?
>
> TIA,
> Rube
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Thanks. Dead link though. Found another here:
http://www.microsoft.com/windows2000/en/advanced/help/default.asp?url=/windows2000/en/advanced/help/dsadmin_domain_delegate_control.htm

Thanks for the point in the right direction!


"Chriss3 [MVP]" <noSpamHere@chrisse.se> wrote in message
news:%23Wzdpd91EHA.3576@TK2MSFTNGP12.phx.gbl...
> Hello Rube,
> Take use of the Delegate of Control Wizard.
>
> See the Step-by-Step Guide to Using the Delegation of Control Wizard
> This guide shows how to delegate control of objects in an Active Directory
> service container, using the Delegation of Control wizard in the Active
> Directory Users and Computers snap-in.
>
>
http://www.microsoft.com/windows2000/techinfo/planning/activedirectory/delegsteps.asp
>
>
> --
> Regards
> Christoffer Andersson
> Microsoft MVP - Directory Services
>
> No email replies please - reply in the newsgroup
> ------------------------------------------------
> http://www.chrisse.se - Active Directory Tips
>
> "Rube" <dont@spam.me> skrev i meddelandet
> news:%23DFlcQ91EHA.2012@TK2MSFTNGP15.phx.gbl...
> > Hi All,
> >
> > I would like to offload everyday management of security group & user
> > maintenance to a member of our HR team who was a network admin in a
> > previous
> > life. This person would be allowed to use Active Directory Users &
> > Computers
> > to add new users & change group memberships in the domain, as well as
> > change
> > file & folder security in the HR file server. I would prefer not to make
> > them a domain admin obviously. . .
> >
> > Any recommendations or caveats? Anyone else do this? What permissions do
I
> > have to give this HR person to allow them to accomplish the above tasks?
> >
> > TIA,
> > Rube
> >
> >
>
>