Giving users control over domain user accounts

[Jeff7181]

I'm curious what implementations others have seen in reference to giving users control over the domain user accounts of employees underneath them. For example... a small branch office that doesn't have dedicated IT staff and we don't want the users calling corporate IT support for simple password resets so we'd like to give the branch manager the ability to reset their passwords and unlock their accounts. I'm assuming this is a Windows domain by the way...

Obviously they could just be given these rights for a specific OU in AD. However, training some people to use the AD console in Windows could be a problem. So I guess the other option could be a web based form, right? Is there something more simple that I'm missing?

 

[her209]

So I guess the other option could be a web based form, right?

How does a user access a web page if they can't log in?

 

[Jeff7181]

How does a user access a web page if they can't log in?

This would be for a manager to reset one of their employees passwords. Sorry if that wasn't clear.

 

[theevilsharpie]

However, training some people to use the AD console in Windows could be a problem.

Not really.

 

[Saga]

Very easy to make an AD MMC snapin for this task with elevated user roles given to managers at the time of employee AD creation/change/etc.

My problem was always that managers considered themselves above these types of tasks regardless of organizational size.

 

[Jeff7181]

Not really.

I've had people ask where the Start button is... or where an OK button is. Trust me, there would be problems training certain people to use AD.

A MMC snapin might dumb it down enough so that they weren't confused by all the other stuff you see in AD Users and Computers. Thanks, Saga.