RabbieBurns Posted November 4, 2008 Posted November 4, 2008 I want to give a member of staff control over a group of students in active directory, such as change password etc. Is there a Microsoft mmc that can be used on their local machine or does it require a 3rd party utility. Also, what groups do I need to add this staff member to so they can control only the specified group and not the entire domain?
ricki Posted November 4, 2008 Posted November 4, 2008 Hi You can do this but I would not advice it. You would have to create ou's in users and computers and then populate them move the users and computers you want them to control. Then you would have to deligate control to that person. I have seen this done in business but never in education. Richard
Domino Posted November 4, 2008 Posted November 4, 2008 Its fine to do, but you need to make sure your permissions are properly set, and customize the mmc highly to make sure they only get the items they're supposed to. The other thing is, i think (though I'm not 100 percent) you need the network admin tools pack installed wherever it'll be used. I'd personally spend the time setting up a self-service password reset.
RabbieBurns Posted November 4, 2008 Author Posted November 4, 2008 Hi You can do this but I would not advice it. You would have to create ou's in users and computers and then populate them move the users and computers you want them to control. Then you would have to delegate control to that person. I have seen this done in business but never in education. Richard The users I want the member of staff to have control over are already in the one OU. How do I delegate control?
RabbieBurns Posted November 4, 2008 Author Posted November 4, 2008 Its fine to do, but you need to make sure your permissions are properly set, and customize the mmc highly to make sure they only get the items they're supposed to. The other thing is, i think (though I'm not 100 percent) you need the network admin tools pack installed wherever it'll be used. I'd personally spend the time setting up a self-service password reset. Does the network admin tools pack contain the mmc that they will use? It is the head of primary that is wanting the control, its the juniors accounts he will be doing this for, they are probably too young to manage a self-service thing.
Domino Posted November 4, 2008 Posted November 4, 2008 google is your friend... Create a password administrator using the Delegation Of Control Wizard
TimTech Posted November 4, 2008 Posted November 4, 2008 The users I want the member of staff to have control over are already in the one OU. How do I delegate control? Right-click on the OU and Delegate Control is your top option. Be sure this is what you want to do though. It sounds simple, but teachers have a way of destroying networks:doh:
RabbieBurns Posted November 4, 2008 Author Posted November 4, 2008 Thanks Im at the download page for the server administration pack Download details: Windows Server 2003 R2 Administration Tools Pack (x86) This guy is also one of only 2 computers in the whole school that uses vista. Does the admin pack work on vista does anyone know?
RabbieBurns Posted November 4, 2008 Author Posted November 4, 2008 actually I dont think those are the ones that I want
penfold Posted November 4, 2008 Posted November 4, 2008 On a side note to this, is it possible to allocate permissions for OU so that you can have people apply group policies, but only on that OU? For example allowing the technology technician control over their computers? We have a technology technician who was taken on to assist with all the technology department including computers. However, they have never touched the computers and now the network has grown I would like to push more work back in their direction. They started before I did so it was never picked up, but I would like to distribute some of the work now. In this case I dont want to allow full access to group policies for the whole network, but they can do what they want (within reason) to the computers they are supposed to look after. So could I set up a standard policy with no override and then let the technician look after the software on their computers? I understand the potential issues that could arise, but if this is possible then at least I could highlight the problem of my workload with a solution to SMT. I would be willing to train them so they had an understanding of how to deploy software etc, but the only other solution would be to employ a 2nd techie and that wont happen. So this is me grasping at straws. Any advice?
Kitkatninja Posted November 4, 2008 Posted November 4, 2008 (edited) After you use the delegation of Control wizard in ad, instead of installing the admin pack for XP, you can install this program. They get what they need to do it, nothing more, nothing less. ...Does the admin pack work on vista does anyone know? No, but there is a work around if you really want the XP admin pack on Vista, but it's not 100% compatible. However I would recommend using RSAT for Vista, this is the new version of the XP admin pack that is designed for Vista. -Ken Edited November 4, 2008 by Kitkatninja formatting/grammer
RabbieBurns Posted November 4, 2008 Author Posted November 4, 2008 After you use the delegation of Control wizard in ad, instead of installing the admin pack for XP, you can install this program. They get what they need to do it, nothing more, nothing less. No, but there is a work around if you really want the XP admin pack on Vista, but it's not 100% compatible. However I would recommend using RSAT for Vista, this is the new version of the XP admin pack that is designed for Vista. -Ken That wisesoft thing looks the business. Thanks. I cant seem to find the section on the website to get a free code though, even after registering with the site?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now