Teachers & AD.

[boomam]

Hi.

 

Does anyone here have a method to give teachers access to the ability to enable/disable accounts, move users to another OU (internet ban for example) and reset passwords?

 

We do have SSPR for passwords, however it doesnt allways work for some bizzare reason, and if i create a custom MMC for the rest, they can technically view the entire AD structure, and for the life of me, i cant work out how to disable the other functions, like delete, properties, ect;

 

What methods do all you lot use?

 

Thanks in advance all. .

[wizzard]

I would let the teachers teach, are you suggesting this because your workload is so heavy?

[boomam]

Because a certain teacher has been demanding it for when i got on holiday in a few weeks, otherwise he cant do that without me.

 

I dont mind, as long as i can lock out bits that i dont want him to access/do.

Its literally just the pupils OU and its sub OUs. Nout else.

[Domino]

if you just give him relevant permissions (change password etc) for the various ous it should be fine, as long as the permissions are denied on others you don't want him to have access to.

 

You should also be able to remove right click and toolbars from the mmc and add links to the functions you want to give him.

[box_l]

I have given a couple of teachers an ou specific MMC and then delegated the "change passwords" role to them on that ou.

 

it works ok, but i would not give it to most teachers, just the ones who are IT coordinators etc

 

I am waiting for a colleague to finish writing his new app, (bit like URMA tools4ever), webserver based AD control and all-round user management. this wiil mean i can publish a page for teachers to log in to and they will get the password change for their class and nothing else.

 

looking forward to it

 

BoX

[maniac]

I've written a simple password changing program which allows teachers to reset student passwords with a couple of clicks of the mouse. Requires .NET 3.5 to run thou as it was done in visual basic express 2008.

 

I will share it if people are interested.

[Netwacky87]

Defo! Please Share!

[FN-GM]

I've written a simple password changing program which allows teachers to reset student passwords with a couple of clicks of the mouse. Requires .NET 3.5 to run thou as it was done in visual basic express 2008.

 

I will share it if people are interested.

 

Yes please

[maniac]

I'll stick it up soon then.

 

I just need to de-brand it as it's customised for our school at the moment with our logo in it etc.

[EduTech]

Oh please share, thats worth paying for in my eye's would help allot as far as password changes are concerned.. but agree that i myself would only give it to the ICT Teachers if anything..

 

Looking forward to this.

 

James.

[antoeknee]

We've recently found a free app that allows password changes.

 

Delegate control to change password for the relevant group of users on the specific OU.

 

Run the app and input user ID, user name is shown. The password can be changed to anything here. Though we've chosen to have a defined string and force password change at next logon.

 

Doesn't allow change to other OU's (an access is denied message is shown) and even though there is a disable account button this won't work as we've not allowed this in AD either.

 

I'll post a link when I get in tomorrow

[Theblacksheep]

Passmanager by MST works well. Dont know if its CC3 specific tho...

[Gatt]

Password Control from Wisesoft works great too - even does Bulk Password resets and can enabe/disable accounts

 

Though do have slight issues with my install at moment but its prob something I've done

[amfony]

Password Control from Wisesoft works great too

 

Yep - concur. Simple and effective and even better you can disable buttons and such by editing an XML file.

[PyROm]

We have a php script that allows certain teachers to change passwords without knowing the old one, it runs on a linux machine via apache connected to win2k3 ads.

 

It uses that net ads command( "net ads password $name@DOMAIN $new_password -U $admin_user@DOMAIN%$admin_pass") to change it, because we pass an account with permission to change passwords we dont need to allow teachers to have any permissions in AD. We limit who can use the script in the script itself (doing lookup of whos connected to network drives at that ip address, with an exception for terminal services). Also we do a lookup and display if the user is disabled etc. stops them wondering why password change didnt work (ie. they cant log in).

[boomam]

That .net v3.5 app sounds interesting. Eagerly awaiting....

 

I can get my custom MMC, in combination with delegation to allow them to do what i want, but i dont seem to be able to disable account deletion. .

 

Ideas?

 

I need to to be able to enable/disable accounts, reset passwords & move pupils between the pupil OUs.

[boomam]

You should also be able to remove right click and toolbars from the mmc and add links to the functions you want to give him.

How do i do that? I cant find the settings?

[maniac]

For those that were interested, I've posted my Easy Password Reset software in a new thread.

 

http://www.edugeek.net/forums/windows/23952-easy-password-reset-software.html

 

Mike.

[boomam]

Thanks for that.

 

Just got around to messing with MMC again, got a right wierd problem now.

Users, even those with MMC rights, cant open MMCs now, 'this function is not supported by the system' errors?

 

Anyone got any ideas on that?

 

Also, how do i disable right clicks in MMC? Or at least disable specific right click functions?

 

Thanks.