Assign users with rights to reset password in Active Directory

This brief guide shows you how to assign users with right to reset password in Active Directory (AD) to reset Password. Please see “What to note before assigning Multiple IPs’ to an Instance“, and how to perform Microsoft Account Password Reset via Web and Windows. Delegation in Active Directory (AD) is the process of granting specific users or groups permissions to perform administrative tasks for specific objects or services within the Active Directory environment.

This allows organizations to distribute administrative responsibilities without giving full administrative rights, enhancing security and operational efficiency. Here’s a detailed overview of delegation in AD.

Also, see How to reset and reinstall Windows 10 locally, Add or delete users and set permissions in Azure AD, and how to “Reset and reinstall Windows 10 from the cloud and how to recover your Windows 10 when you cannot boot to Windows“.

Why Perform Account Delegation?

By delegating specific permissions instead of granting full administrative rights. Organizations can adhere to the least privilege principle. Thereby reducing the risk of accidental or malicious change.

This in-turn, enable domain administrators to delegate control over specific subsets of the directory or OUs. Thereby, making it easier to manage permissions.

For related guides see: How to Change User Account Type in Windows 10, Create Multiple Users with Passwords in Ubuntu Linux and Error 1385: The user has not been granted the requested logon type at this time.

Delegate Rights in Active Directory

Since we will be having multiple users perform this duty. We would like to create a security group to help simply user right rights assignment.

To do this, Hit the “Windows + R” key. Type dsa.msc, and hit Enter to open the Active Directory Users and Computers snap-in.

Note: Create a Security group (This simplifies adding individual users) if you do not already have one. Add users as members to this security group

Create an OU if one does not exist before. Right Click and Delegate this right to the OU to reset password. Here add the Security group created and that is all.

I hope you found this blog post on Assigning users with rights to reset password in Active Directory helpful. If you have any questions, please let me know in the comment session.