GSuite admin role password changes

[Sheridan]

Got an odd issue with user management in our Google domain. We have a few users who have the User Management Admin role to reset passwords of all accounts (staff and students) and also a more restricted 'Teachers' role that only allows those users to change passwords of users in a specific OU (i.e students)

 

The issue is the members of the higher level User Management role cannot reset the passwords of those users who have the Teachers role. They can change everyone's password apart from the half dozen or so with the lower role, as the reset password shows up as greyed out

 

Google support don't seem to be able to help, or aren't sure what I mean, but its almost like users who have any admin role cannot have their password reset by anyone other than those with the Super Admin role, which doesn't seem to match the settings when you look at the role permissions. Basically the built in User Management role should allow reset of anyones password even if they have an admin role as well, or is that just not the case and it is only the super admins who can reset other admins passwords?

[paulkerton]

or is that just not the case and it is only the super admins who can reset other admins passwords?

 

As far as I'm aware only a super admin can reset admin passwords. Admins being able to set each others is a recipe for security issues.

You really want as few people as possible having the ability to reset passwords.

[RLR]

As far as I'm aware only a super admin can reset admin passwords. Admins being able to set each others is a recipe for security issues.

You really want as few people as possible having the ability to reset passwords.

 

This is true. We had this come up a couple years back. We have some users that have some basic admin rights for compliance and we found out our 1st line team couldn't reset their passwords. Google confirmed this is intended.

[Sheridan]

This is what I suspected, its a shame as it means you can't have layered password reset support