Hi,
I want to make it so that helpdesk employees can log in on my management server, to reset passwords and unlock accounts in the AD.
Now I found online how to delegate permissions to allow certain groups to reset passwords, however, you can't log in as a regular user on the management server. Obviously, you can create GPOs that allow this, but then they can also access my GPMC and everything else, they shouldn't get access to.
Is there a way to create a superuser account, that can access the management server and the AD, but not delete users etc. in the AD, but only reset passwords on the AD?
Would like to hear some possible solutions or people who have experience with this.
Regards,
Sven