Which group do staff have to be in to change passwords of students?

[reggiep]

I have the wisesoft password chaning software on my staff workstations but they do not have permissions to change passwords. Does anybody know what I would need to do to fix this?

 

Thanks

[Ric_]

I would have thought that you would need to delegate the relevant permissions in AD (via AD Users & Computers). The group you delegate your permissions to is the one you need to have the password changers as members of.

[DrPerceptron]

You might be able to do it using the Account Operators group... but that group also has the power to shut your DC's down...

 

The most appropriate and recommended way though is as above - delegate the permission to a generic group, then you can grant/revoke the permission as necessary

[maniac]

The way Ric describes is how we do it, I have a security group called 'Change Student Passwords' which has the rights to do this delegated on the correct OU, and I use my easy password change tool - http://www.edugeek.net/forums/windows/23952-easy-password-reset-software.html - to let them actually change the passwords - works a treat.

 

Mike.

[reggiep]

So do I basically need to add the accounts operators group to my staff group so that they can change passwords?

How could I then have this set so they could only change passwords of students in a different ou?

 

Sorry but I have been pounded into a soggy ball of thickness by using CC3 for the last 18 months!

[R0M]

You could right click on the OU and go to delegate Control, It brings up a wizard so you can set it that say the OU called Year7 you can give control to Year7 Teachers group and let them change passwords but not change other details.

 

That's more or less how we have it, then staff can change passwords of students they know.

[DrPerceptron]

Create a password administrator using the Delegation Of Control Wizard

Create Taskpads for Active Directory Operations

 

 

Those two links should help you get a system running in the controllable manor (which i would say is the best way)

 

Use of the Account Operators group is more for corporate networks where the roles are more specific between people...