Delegate Control: Password Reset

[DAckroyd]

Hi all - I've been searching the net and given up to suck the knowlage from your brains instead...

I have a 2008 domin and I have set delegate rights on the students User OU for a group which will be able to reset password for the students and do nothing more...

I have followed instructions in doing this and they always stop when you have setup the delegation... it's the next bit where I get stuck... How do I make it so a teacher in the password reset group can reset the passwords? I have on a workstation opened mmc.exe and couldn't work out how to link the domain users as an object. I have on one of the servers set up the mmc but then when I saved it and ran it on a workstation it was no longer able to see into the active directory. Am I doing something completely stupid or just not finding the required instructions?

any help would be greatfully received,
Thanks, Dave

[jamesreedersmith]

Have you installed the adminpak on the machine so it has the users and computers add in installed and registered? - obviously remove the shortcuts from general user access after installation

[TheLibrarian]

You will need to have the adminpak installed on the PC's that you intent to use your new MMC on.

You could supply a script that lets the user enter a username, the script could set a default password and the change password at next logon attribute.

Do you need more information on how to create a custom mmc?

[DAckroyd]

I'm just installing an Administrator tool pack atm - I'm trying the one for server 2003 as I can't find a 2008 tool pack for running on XP

[mrmontymick]

Any teachers that we give password reset ability have a VBScript on their desktop that they run. They type in the students username and their password is reset.

Generally find it much easier than trying to show teachers how to use the admin tools.

[DAckroyd]

I have the mmc working now and am on a test user who was set to only be able to change students passwords but they can still see everything else in AD - is there a way of making it so they can only see the "Users" OU?
Thanks

[TheLibrarian]

You can select the user OU, right click and choose new window from here.

Close the previous window and the MMC is rooted at the chosen OU.

[bmdixon]

If you open mmc.exe then add the Active Directory snap in you can then create a custom mmc for them to see only what they need to. Select the OU that they need access to, right-click and choose "New window from here". Save that as a custom msc and you should be sorted.

[DAckroyd]

Thanks all - got exactly what I want here

Do I need to have the Tool Kit installed on all computers that I want to allow management from?

[Aaron]

Hi guys

I have been asked to do the same here, we are running server 2008 with windows xp clients and a teacher has asked if it would be possible to reset pupil passwords. I don’t want to give out access to the server but want to make it easy for a staff member to just search for the username and reset password to a default then when the pupil logs in they must change this. If I install the adminpak is this possible to allow staff an easy way of changing the password?

or as mrmontymick has said is there a script that I can use to place on teachers desktops that when they click it just lets them search and click reset password that seems fool proof

[R0M]

I am surprised no one has recommended using Wisesoft's Password Control? Its very easy, with big colourfull buttons and dosnt give the users much they can mess up. We use it to get the Library staff to reset student passwords.

www.wisesoft.co.uk

[DAckroyd]

is anyone using powergui for doing this? either with QuestAD cmdlets or built in AD stuff for 2k8r2.
how do the teachers get on with it?

[Aaron]

Rom

Thank you that looks exactly what i am looking for staff couldnt go wrong with this.