Reset Password

(c) Bonsai Software 2011

V1.0.2.12

Instructions

Place the .exe file and the .config file in a directory. Restrict access to the directory as you see fit.
Restrict access to the .config file so that only administrators can edit it, but that any permitted group
can read it.

The structure of your Active Directory must be with one OU containing a list of OUs within it with pupils within
them.
Eg.

AD ->
	Managed Users ->
				Pupils ->
						Year 5
						Year 6
						Year 7
						Year 8

So, the if your domain was Domain.Local, TopLevelOU mentioned below would be:

OU=Pupils,OU=Managed Users,DC=Domain,DC=Local

Set up a group in your Active Directory, and add anyone you wish to be able to reset passwords to that group.
In the Active Directory Users & Computers MMC, right click on the top level OU and select 'Delegate Control'.
Add your freshly created group to the list, and then select 'Create a custom task to delegate'. Now, select the
'Only the following objects in the folder' radio button, and scroll through the list and tick the following item:

User Objects

Now, on the next screen, choose the following items from the list (you need to tick the 'Property-specific' checkbox):

Reset Password
Change Password
Read UserAccountControl
Write UserAccountControl
Read LockoutTime
Write LockoutTime

Now, finish the wizard, and repeat, selecting 'Organisational unit objects' at the first list screen, and the following
at the property screen:

Read

Edit the .config file as follows:

Group - the name of the group you just set up.
Domain - the FULL domain (eg school.domain.tld)
TopLevelOU - the LDAP path to the OU that contains the OUs with pupils in.
Password - the password that pupil accounts will be reset to.

When you open the exe, it will check membership of the group, and then list the OUs in the TopLevelOU OU,
followed by listing pupil accounts when you then select one of those OUs.

You can either select users using the drop down lists, or by typing their username in directly.