Solved: How to Delegate Access for your Helpdesk or Servicedesk In Active Directory–Page 3

Delegating Permissions for Level 2 Support Engineers

Start of by using the same procedure as you did for Level 1 support, after all they will have those permissions and some more. In fact its easier to just specify both groups when doing the previous section

1. Open ADUC
2. Right click your OU where all your users are located but this time click Delegate Control..
3. Click Next
4. Add the 2nd Line Support Group
   
   
   
5. Select Delegate the following common tasks
   
   
   
   
6. Click Next and Finish

Setting Computer Permissions

That deals with the users objects. However engineers most likely also add,remove machines from the domain and move them from the default computers container to your own defined computers OU. To do this

1. Navigate to the default Computers OU Right Click and Click Properties then click the Security tab
   
2. Click Advanced
3. Click Add
4. Specify your group then click OK
5. On the Object Tab select This object and all descendant objects
   Allow: Create Computer Object
   Allow: Delete Computer ObjectAllow: Write All Properties
   
   
6. There are different ways of setting your security on the OU. Point 5 is one way and here is another way. Both ways accomplish the same task. Navigate to the destination Computers OU(This is the OU that houses your workstations or computers) Right Click and Click Delegate Control
7. Add your group and click Next
8. Select the Create a custom task to delegate  and click Next
   
   
9. Select Only the following objects in the folder (see image below) then click Next
   
   
   
10. Select Write
    
11. Click Next and Finish

That's it!

Summary

This how to guides you through the steps of delegating your servicedesk or help staff the proper permissions in Active Directory for performing their jobs.
It separates the roles of different levels of staff commonly found within an IT Department.
Support Level 1 – Servicedesk or helpdesk staff

• Reset password
• change password
• unlock account
• read attributes of an AD user

Support Level 2 – Desktop engineers/Technicians etc

• Reset password
• change password
• unlock account
• read attributes of an AD user
• Create users
• modify Active Directory Groups
• Join Computers to the domain
• Rejoin Computers to the domain
• Unjoin computers from the domain
• move computers to the proper OU

I hope you found this useful.If you have any questions or comments, I would like hear from you.