Problmes running custon MMC console for staff user

[Kyle]

I have created a custom MMC console that will let a staff user change pupils passwords. i have install the adminpak tools of server 2003 onto the XP workstation. If i log on it works fine but when they staff log on it come up with an error "current policies stop microsoft management console from opening in author mode"

 

I think it is a permission to access something on the c:drive, staff have no c/:drive access when on the network here.

 

 

Can anyone help or suggest any way to get this working.

[Ryan]

Top of my head sounds like it's something to do with the rights for users accessing those commands, specifically the "reset password" one. Bit rusty. Go check it

[markcuk]

you have to add the member of staff to the account operators group

 

mark

[Wiseman82]

Check this setting:

 

http://technet2.microsoft.com/windowsserver/en/library/ddf98fab-61f9-4267-9b31-e795d0ae61db1033.mspx?mfr=true

 

Also, I wrote a tool for resetting AD passwords which many users prefer over a custom MMC:

http://www.wisesoft.co.uk/Products/PasswordControl/Main/default.aspx

 

Hope this helps,

 

David

[Kyle]

I am still trying to get this working, I have installed the admin tools on staff members laptop and put the custom msc concole on but they cannot use it. i have tried putting the custom console onto a shared area it still does not work. It comes up with an error 'Current Policies prevent the microsoft management Console from opening in author mode. Consult your administrator for details.'

 

 

Wiseman

 

I like your password changer, is there anyway it can limited so they can only search through certain OU's ie, the pupil one?

Edited April 15, 2008 by Kyle

[Kyle]

Found out what it was witht he custom MMC.

 

I had it running in author mode, as soon as si changed it to limitied user it worked.

 

 

@Wiseman

 

I would still like to know if you can limit what your password software has access to?

[ChrisH]

Found out what it was witht he custom MMC.

 

I had it running in author mode, as soon as si changed it to limitied user it worked.

 

 

@Wiseman

 

I would still like to know if you can limit what your password software has access to?

 

Just make sure you only delegate the user permission to change the passwords of the users in the OUs that you want them to.

[Wiseman82]

Just make sure you only delegate the user permission to change the passwords of the users in the OUs that you want them to.

 

I advise people to secure their domain from Active Directory rather than from applications. If you use custom security within an application, users can always write a script of download another app to bypass the application level restrictions.

 

I created a quick article about delegation:

Password Control for Active Directory - Security

 

Although I advise using Active Directory to control security, there is an alternative method you can use to hide accounts from Password Control:

Password Control for Active Directory - Hide Accounts