Delegate Control: Password Reset

DAckroyd · 13-11-2009, 01:00 PM

Hi all - I've been searching the net and given up to suck the knowlage from your brains instead...

I have a 2008 domin and I have set delegate rights on the students User OU for a group which will be able to reset password for the students and do nothing more...

I have followed instructions in doing this and they always stop when you have setup the delegation... it's the next bit where I get stuck... How do I make it so a teacher in the password reset group can reset the passwords? I have on a workstation opened mmc.exe and couldn't work out how to link the domain users as an object. I have on one of the servers set up the mmc but then when I saved it and ran it on a workstation it was no longer able to see into the active directory. Am I doing something completely stupid or just not finding the required instructions?

any help would be greatfully received,
Thanks, Dave

jamesreedersmith · 13-11-2009, 01:06 PM

Have you installed the adminpak on the machine so it has the users and computers add in installed and registered? - obviously remove the shortcuts from general user access after installation

TheLibrarian · 13-11-2009, 01:07 PM

You will need to have the adminpak installed on the PC's that you intent to use your new MMC on.

You could supply a script that lets the user enter a username, the script could set a default password and the change password at next logon attribute.

Do you need more information on how to create a custom mmc?

DAckroyd · 13-11-2009, 01:15 PM

I'm just installing an Administrator tool pack atm - I'm trying the one for server 2003 as I can't find a 2008 tool pack for running on XP

mrmontymick · 13-11-2009, 01:26 PM

Any teachers that we give password reset ability have a VBScript on their desktop that they run. They type in the students username and their password is reset.

Generally find it much easier than trying to show teachers how to use the admin tools.

DAckroyd · 13-11-2009, 01:32 PM

I have the mmc working now and am on a test user who was set to only be able to change students passwords but they can still see everything else in AD - is there a way of making it so they can only see the "Users" OU?
Thanks

TheLibrarian · 13-11-2009, 01:35 PM

You can select the user OU, right click and choose new window from here.

Close the previous window and the MMC is rooted at the chosen OU.

bmdixon · 13-11-2009, 01:36 PM

If you open mmc.exe then add the Active Directory snap in you can then create a custom mmc for them to see only what they need to. Select the OU that they need access to, right-click and choose "New window from here". Save that as a custom msc and you should be sorted.

DAckroyd · 13-11-2009, 01:49 PM

Thanks all - got exactly what I want here

Do I need to have the Tool Kit installed on all computers that I want to allow management from?

Welcome, Register for free! or Login below:
User Name		Remember Me?
Password

13-11-2009, 01:00 PM	#1
DAckroyd Join Date: Feb 2009 Posts: 460 Thanks: 66 Thanked 34 Times in 21 Posts Blog Entries: 1 Rep Power: 10	Delegate Control: Password Reset Hi all - I've been searching the net and given up to suck the knowlage from your brains instead... I have a 2008 domin and I have set delegate rights on the students User OU for a group which will be able to reset password for the students and do nothing more... I have followed instructions in doing this and they always stop when you have setup the delegation... it's the next bit where I get stuck... How do I make it so a teacher in the password reset group can reset the passwords? I have on a workstation opened mmc.exe and couldn't work out how to link the domain users as an object. I have on one of the servers set up the mmc but then when I saved it and ran it on a workstation it was no longer able to see into the active directory. Am I doing something completely stupid or just not finding the required instructions? any help would be greatfully received, Thanks, Dave

13-11-2009, 01:49 PM	#9
DAckroyd Join Date: Feb 2009 Posts: 460 Thanks: 66 Thanked 34 Times in 21 Posts Blog Entries: 1 Rep Power: 10	Thanks all - got exactly what I want here Do I need to have the Tool Kit installed on all computers that I want to allow management from? Last edited by DAckroyd; 13-11-2009 at 02:12 PM..

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Self Service Password Reset	plexer	EduGeek Self Service Password Reset	243	Yesterday 07:18 PM
Delegate control - Unlock Accounts	Gatt	Windows Server 2008	1	24-09-2008 11:50 AM
Specops Password Reset	linkazoid	Windows	7	16-05-2008 02:27 PM
reset admin password	fafster	Windows	11	27-02-2008 11:01 AM
bulk password reset	Jonny_sims	Windows	8	04-09-2007 10:51 PM

Thread Tools	Search Thread
Show Printable Version Email this Page	Search Thread: Advanced Search

		EduGeek.net Forums > Technical > Windows Server 2008
Delegate Control: Password Reset

13-11-2009, 01:06 PM	#2
jamesreedersmith Join Date: Sep 2009 Location: Grantham Posts: 206 Thanks: 34 Thanked 42 Times in 36 Posts Rep Power: 8	Have you installed the adminpak on the machine so it has the users and computers add in installed and registered? - obviously remove the shortcuts from general user access after installation

13-11-2009, 01:07 PM	#3
TheLibrarian Join Date: Apr 2009 Location: Wolverhampton Posts: 307 Thanks: 31 Thanked 74 Times in 58 Posts Rep Power: 16	You will need to have the adminpak installed on the PC's that you intent to use your new MMC on. You could supply a script that lets the user enter a username, the script could set a default password and the change password at next logon attribute. Do you need more information on how to create a custom mmc?

13-11-2009, 01:15 PM	#4
DAckroyd Join Date: Feb 2009 Posts: 460 Thanks: 66 Thanked 34 Times in 21 Posts Blog Entries: 1 Rep Power: 10	I'm just installing an Administrator tool pack atm - I'm trying the one for server 2003 as I can't find a 2008 tool pack for running on XP

13-11-2009, 01:26 PM	#5
mrmontymick Join Date: Mar 2009 Location: Peterborough, UK Posts: 32 Thanks: 5 Thanked 12 Times in 6 Posts Rep Power: 4	Any teachers that we give password reset ability have a VBScript on their desktop that they run. They type in the students username and their password is reset. Generally find it much easier than trying to show teachers how to use the admin tools.

13-11-2009, 01:32 PM	#6
DAckroyd Join Date: Feb 2009 Posts: 460 Thanks: 66 Thanked 34 Times in 21 Posts Blog Entries: 1 Rep Power: 10	I have the mmc working now and am on a test user who was set to only be able to change students passwords but they can still see everything else in AD - is there a way of making it so they can only see the "Users" OU? Thanks

13-11-2009, 01:35 PM	#7
TheLibrarian Join Date: Apr 2009 Location: Wolverhampton Posts: 307 Thanks: 31 Thanked 74 Times in 58 Posts Rep Power: 16	You can select the user OU, right click and choose new window from here. Close the previous window and the MMC is rooted at the chosen OU.

13-11-2009, 01:36 PM	#8
bmdixon Join Date: Apr 2008 Location: Birmingham Posts: 133 Thanks: 15 Thanked 17 Times in 14 Posts Rep Power: 6	If you open mmc.exe then add the Active Directory snap in you can then create a custom mmc for them to see only what they need to. Select the OU that they need access to, right-click and choose "New window from here". Save that as a custom msc and you should be sorted.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)