Account Operators

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Hello All,

I've added users accounts to the account operators group to help manage
domain accounts. However, users in the account operators group can't manage
other accounts in the account operators. Why is this?

Vincent

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Because Microsoft specifically set it up that way. Account operators are
specifically protected from being able to muck with each other. It is just one
reason why you shouldn't use Account Operators versus using delegated permissions.

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


vincent-nyc wrote:
> Hello All,
>
> I've added users accounts to the account operators group to help manage
> domain accounts. However, users in the account operators group can't manage
> other accounts in the account operators. Why is this?
>
> Vincent