The Principle of Least Privilege
In many organizations, the IT Helpdesk staff are granted full Domain Admin rights simply because they need the ability to reset user passwords or unlock accounts. This violates the security principle of least privilege and opens the entire network to massive risk if a Helpdesk account is compromised. By using the Delegation of Control Wizard in Active Directory, you can grant standard users precise, granular permissions (like resetting passwords in a specific Organizational Unit) without giving them any administrative rights over the domain or servers.
Step 1: Create a Dedicated Security Group
You should never delegate permissions to individual user accounts; always delegate to a group. Open Active Directory Users and Computers (ADUC).
Navigate to your IT or Groups OU, right-click, and select New > Group. Name the group something descriptive, such as Helpdesk-Password-Admins, and ensure it is a Global Security group. Add your Helpdesk staff members to this group.
Step 2: Launch the Delegation of Control Wizard
You must decide where you want these permissions to apply. If you only want the Helpdesk to reset passwords for standard employees (but not executives or other IT staff), you should delegate control specifically at the Employees Organizational Unit (OU) level.
Right-click the target Organizational Unit (e.g., OU=Employees,DC=corp,DC=local) and select Delegate Control….
Step 3: Select the Target Group
The Delegation of Control Wizard will appear. Click Next on the welcome screen.
On the “Users or Groups” page, click Add…. Search for and select the Helpdesk-Password-Admins security group you created in Step 1. Click Next.
Step 4: Assign the Specific Tasks
The “Tasks to Delegate” page offers a list of common administrative actions. To allow the group to handle basic account lockouts and password issues, check the following boxes:
- Reset user passwords and force password change at next logon
- Read all user information
(Note: If you need to grant advanced permissions, such as allowing them to edit specific custom attributes, you can select “Create a custom task to delegate” instead).
Step 5: Verify the Permissions
Click Next, review the summary, and click Finish.
To verify the permissions applied correctly, you must enable Advanced Features in ADUC (Click View > Advanced Features). Right-click the OU you delegated, select Properties, and go to the Security tab. You will now see your Helpdesk-Password-Admins group listed with specific “Special permissions” granted for that OU. Your Helpdesk staff can now safely reset passwords using the standard ADUC console installed on their local workstations.