Deligation of account control

[timlineuk]

Hi all,

 

does anyone know of any means of giving certain members of staff the ability to lock, unlock and change password on user accounts?

 

i know that you can deligate under AD but i dont want to give staff access to MMC

 

A web based solution would be preferable

 

Cheers

[linkazoid]

Delegate control in MMC then install Password Reset from Wisesoft.co.uk on the teachers PC.

 

Works Great Here.

 

Michael

[timlineuk]

Excellent, thanks... i'll give it a go

[zippo]

The problem I see with this route is that this solution actually gives the selected staff complete control over all accounts, including admin accounts and other staff members. Not sure if this is a good thing.

[linkazoid]

You can delegate to groups or OU's IIRC. Staff here can only change student passwords.

 

Only we can change staff passwords.

 

Michael

[timlineuk]

The problem I see with this route is that this solution actually gives the selected staff complete control over all accounts, including admin accounts and other staff members. Not sure if this is a good thing.

 

 

I dont think it will as they log in with their own network credentials,

 

so long as the delegation security on the OU is set correctly they shouldn't be able to make any changes to users accounts...

They might well be able to see all accounts but not necessarily do anything with them.

 

dont worry it will be rigerously tested first

[waldronm2000]

You could create a taskpad view in MMC with just the tasks you've delegated, lock it down, and just give them access to that.

[timlineuk]

OK - i've tested out the various options but am still at a loss.

 

Wisesoft password control works brilliantly for sorting out individual accounts but the bulk control is seemingly quite unsecure when in the hands of staff as it appears to allow them to enable and disable any account they wish, i dont beleive they could change password without permission but this ability alone could cause all sorts of issues.

 

Taskpad view also appear to work well but would require another OU to be created and giving the users higher level local access before it'll allow them into MMC author mode.

 

The reason (before being asked) for needing bulk control is the introduction of various IT based exams in ICT, Business studies, etc. we've a set of exam accounts that need to be locked and unlocked during exam times, it would make it far easier for the staff running the exams to be able to do this temselves.