What permissions to manage snap-in computers and users in AD (WS2019)

Question

Hello all! I need a little help. I have a new colleague and i need to give him permissions to access to snap-in users and computers in AD. I've tested settings in polices, delegations, and groups but it doesn't work. Local admin to - he is local admin now. I don't want to make him domain admin. I do something wrong - what permissions should I give in WS 2019 ? Thank you in advance Greg

Answer 1

Hi,
If the user need to create new user, add to group, change password etc, you can use the delegation control to grant proper permissions without add it to admins group.
Right click the domain name or OUs which you want to assign permission:


Select the permission you want to assign, or you can try to customer a task:

Answer 2

Hi,
Based on my understanding ,you want to assign permission to a user to access the ADUC from a member server or workstation, right?
It don't need the domain admin permission to do this.
The default security is read for Authenticated Users. As following:

For the special permissions is :read permission and read all properties permission.

If you don't have the permission, we need to assign the permission the users.
Right click the domain name or OU name from ADUC on DC.
From the security ,add the user and assign the permission as above screenshot showing .

Best Regards,

Answer 3

Hello!
Thank you for your answer.
There is no problem with access to this snap-in. Look at your picture - (everyone - Read all properties)

But I forgot to say that is new administrator (junior) and He need to do admin work on users account on serwer. I mean he need create new user, add to group, change password etc, etc. Now he have only read. If I'll put his account in domain admin group, he can do what he need, but I don't want to do yet. Is another way to do it?

Answer 4

Hi,

You can delegate the admin account to manage user and computer accounts on each OU level using wizard delegation :

You can refer to the links below :

delegating-administration-by-using-ou-objects

delegate-permission-reset-ad-user-account-passwords

----------

Please don't forget to mark helpful reply as answer

Answer 5

Thank You, works great!

Echm ... but is possible to revoke this delegation? :DDD