Accounts operators have more permissions that just resetting passwords. Here is the information from MS documentation.
Account Operators Members of this group can create, modify, and delete accounts for users, groups, and computers located in the Users or Computers containers and organizational units in the domain, except the Domain Controllers organizational unit. Members of this group do not have permission to modify the Administrators or the Domain Admins groups, nor do they have permission to modify the accounts for members of those groups. Members of this group can log on locally to domain controllers in the domain and shut them down. Because this group has significant power in the domain, add users with caution. Source: http://technet2.microsoft.com/WindowsServer/en/library/1631acad-ef34-4f7 7-9c2e-94a62f8846cf1033.mspx?mfr=true Happy holidays -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael Miller Sent: Friday, December 22, 2006 7:39 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Delegate Password Resets I put the user accounts of the helpdesk personnel in the built in group, Account Operators. This is precisely why I think that group exists. -mjm Salandra, Justin A. wrote: > > I wanted to find out from all of you what ways you have delegated > password reset functions to your helpdesks. We have a product that > does this but it is continually having problems and want to know if > there are nay other ways. > > > > Justin A. Salandra > > MCSE Windows 2000 and 2003 > > Network and Technology Services Manager > > Catholic Health Care System > > 646.505.3681 > > cell 917.455.0110 > > [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > > > List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir@mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir@mail.activedir.org/