Hello,
We are using Win2008R2 Std Active Directory and I would like to create a new group for new IT starters. They will need access to join computers to the domain, install software on domain computers, look at logs, run maintenance tasks and create accounts and reset passwords. I don't want them to be able to mess with domain admin accounts.
I have created a group "First Line" and made it a member of "Account Operators", "Performance Log Users", "Performance Monitor Users" and "Print Operators". I assigned my test user to the group and logged onto a domain computer using the account. I found that I could reset the domain Administrator's password!
Please could someone explain what I'm obviously misunderstanding here? How can a non-admin change admin passwords? Am I going about this all wrong?
Thanks in advance.
Elliot