Account Operators cannot change their Own passwords

Discussion in 'Windows Server' started by DVOLLIN, Jan 14, 2006.


    DVOLLIN Guest

    I have a number of techs that require the ability to change their own
    passwords in Active Directory. Whenever one of them try and change their own
    passwords using Active Directory they get a message that says Access Denied.
    I though account operators could change passwords. The techs have no problem
    changing other peoples passwords. What is going ON? If anyone can help I
    sure would appreciate it.
    DVOLLIN, Jan 14, 2006
    1. Advertisements

  2. Only members of the Domain Admins group can change the passwords of other
    Account Operator (unless the Account Operator is changing their own
    Todd J Heron [MVP], Jan 14, 2006
    1. Advertisements

  3. Just to add to that, it is important to understand the difference between
    changing your password and resetting your password.

    Oli Restorick [MVP], Jan 14, 2006

    DVOLLIN Guest

    Maybe I'm not being clear. I understand that only domain admins can change
    other account operator passwords. That is not the issue. The issue is that
    the techs who are members of the account operators group cannot RESET their
    OWN passwords. They get an access denied prompt. I have also tried
    delegating and that does not work either. Thank you for your help in this
    DVOLLIN, Jan 14, 2006
  5. Yes, it is a known limitation of that built-in group. Several years back I
    was an account operator at a large enterprise, and I couldn't reset my own
    password via User Manager for Domain or ADUC but I could change it
    (CTRL+ALT+DEL then hit the Change password button).
    Todd J Heron [MVP], Jan 14, 2006
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.