Printable View
HI, I’m Administrator of Windows Server 2003 / Domain. There are several users connected with this. One of them is having “Account Lock out” on his account. I granted him permissions to reset his password but don’t know why he is still not able to uncheck the lock out option.
Can anybody please tell me what else permissions do I need to provide him or is there any workaround for the same? Thank you.
Hello friend. In order to delegate a user the account unlock rights, you will need to go through this:
- Create the group or user account that you want to have the right to unlock user accounts in Active Directory Users and Computers (for example, Help Desk Admins).
- Right-click the domain in Active Directory Users and Computers, and then click Delegate Control from the menu that is displayed.
- The Delegation of Control Wizard should be displayed. On the Welcome dialog box, click Next.
- On the Users and Groups dialog box, click Add. Select the group in the list that you want to give the right to unlock accounts, and then click OK. On the Users and Groups dialog box, click Next.
- On the Tasks to Delegate dialog box, click Create a custom task to delegate, and then click Next.
- On the Active Directory Object Type dialog box, click Only the following objects in the folder:. In the list, click User objects (the last entry in the list), and then click Next.
- On the Permissions dialog box, click to clear the General check box, and then click to select the Property-specific check box. In the Permissions list, click to select the Read lockoutTime check box, click to select the Write lockoutTime check box, and then click Next.
- On the Completing the Delegation of Control Wizard dialog box, click Finish.
I appreciate your help Agilent but i wanted to know a way to delegate a domain user account which will allow this account to join unlimited numbers of workstations to the domain. But as per the solution provided, it seems like it was for using Domain administrator account to join workstation to the domain which i dont want. So any other help please?
I think you need to check this Microsoft KB. It is pretty old but it has some info that the new one you refrenced does not. hope it helps. http://support.microsoft.com/kb/279723/en-us