Staff resetting passwords

[MarkBerridge]

I am looking at a way to give staff access to reset pupil passwords but not to give them any admin access. We use a 2008 r2 windows domain. Can anyone recomend a good way of implementing that?

[Guest TheLibrarian]

Create a custom MMC and use the delegate control wizard on the appropriate OU containing the pupil accounts.

[MarkBerridge]

How would the staff then see how to reset the passwords? Remote Server Administration Tools?

[Guest TheLibrarian]

That would be the custom MMC part.

 

You can focus the MMC on a particular part of AD, and as long as you have delegated control they can use that to reset passwords.

[Guest TheLibrarian]

 @echo offsetlocal


:start
cls
echo,
echo,
set /p _username_=Please enter the username :


if "%_username_%" == "q" goto end


for /f "tokens=1* delims=*" %%i in ('dsquery user -limit 1 -samid "%_username_%"') do (
echo %%i
set _upn_=%%i
if NOT "%%i" == "" goto chpwd
)


goto start




:chpwd
dsmod user %_upn_% -pwdneverexpires no
dsmod user %_upn_% -pwd 123456 -mustchpwd yes


:end

 

I'm lazy and use this script to reset passwords.

[MarkBerridge]

So when delegating control, can you minimise what the user sees in AD? I dont really want them to see everything

[icttech]

We use Password Control, its a free application, easy to install.

 

we had if installed on our server (2008r2) and have a link to it on our staff profiles.

 

Works a treat. PM me if you want some more info.

[Guest TheLibrarian]

They would see everything that they have permission to, but they would not be able to change anything.

 

I don't think it really matters what the teachers see, only what they can change. (Just my £0.02)

[Guest TheLibrarian]

We use Password Control, its a free application, easy to install.

 

Post a link?

[MarkBerridge]

They would see everything that they have permission to, but they would not be able to change anything.

 

I don't think it really matters what the teachers see, only what they can change. (Just my £0.02)

 

You've been very helpful, thankyou

[MarkBerridge]

A link would be very helpful on here please

[dave.81]

A quick google took me to this... going to try it out later.

 

Password Control

[Guest TheLibrarian]

You've been very helpful, thankyou

 

You are welcome.

[sonofsanta]

Custom MMC - in a normal AD MMC, right click on the OU you want them to see and choose New Window. Save that as a new MMC and put it somewhere they can all get to. Delegate the relevant permissions to staff on that OU. Easy peasy!

[MarkBerridge]

Custom MMC - in a normal AD MMC, right click on the OU you want them to see and choose New Window. Save that as a new MMC and put it somewhere they can all get to. Delegate the relevant permissions to staff on that OU. Easy peasy!

 

Brilliant thanks

[sonofsanta]

Brilliant thanks

 

Should say - you'll need to install the relevant 2008R2 Administration Tools on the workstations for the MMC to work elsewhere. Windows 7 one is here: Download: Remote Server Administration Tools for Windows 7 with SP1 - Microsoft Download Center - Download Details

[MarkBerridge]

Should say - you'll need to install the relevant 2008R2 Administration Tools on the workstations for the MMC to work elsewhere. Windows 7 one is here: Download: Remote Server Administration Tools for Windows 7 with SP1 - Microsoft Download Center - Download Details

 

Could I reset passwords on a server 2008r2 domain with a Windows XP machine?

[sonofsanta]

Could I reset passwords on a server 2008r2 domain with a Windows XP machine?

 

Could only find mention of Vista and Win7 bits, sorry don't know myself tbh as we're still 2003 based, so that all plays fine with XP. Maybe someone else could shed some light on it?

[Duke5A]

I went through this a few years back and didn't care for the custom MMC approach. For the life of me I can't remember why though... Anyways, I wound up writing a VB app that lets teachers unlock and reset passwords for student accounts. It's been through a couple revisions and one total rewrite as it was written in VB6 in its first version, and then VB .Net 2010. It gives staff a breakdown by grad year in a treeview and allows partial searches for student names and ID numbers. It'll even show student pictures if they have one.

 

The rights to change the lockout and password attributes on the student's accounts must be granted on whatever OU students accounts reside in.

 

Don't be afraid to download VB .Net 2010 Express and give it a try. It was actually a lot of fun learning how to put this together.

 

[morganw]

An easy option.

Reset Student User Password Free Tool for Schools, Business and Education - Burconix