Delegating helpdesk password resets

Posted 19 Apr 2026 · active-directory, delegation, least-privilege

The helpdesk should be able to reset passwords and unlock accounts in one OU, and nothing else. No Account Operators, no Domain Admins. The Delegation of Control wizard does this in a few clicks, but dsacls is what you run when you want it scripted and auditable.

Reset password + unlock on an OU

# grant the Helpdesk group reset-password on user objects in the OU
dsacls "OU=Staff,DC=corp,DC=example,DC=com" /I:S ^
  /G "CORP\Helpdesk:CA;Reset Password;user"

# allow writing lockoutTime (unlock) and pwdLastSet (force change)
dsacls "OU=Staff,DC=corp,DC=example,DC=com" /I:S ^
  /G "CORP\Helpdesk:WP;lockoutTime;user" ^
  /G "CORP\Helpdesk:WP;pwdLastSet;user"

/I:S makes the ACE inherit down to child user objects only. Granting the "Reset Password" control access right lets them set a new password without knowing the old one, which is exactly what a helpdesk needs and no more.

Verify and undo

dsacls "OU=Staff,DC=corp,DC=example,DC=com"        # review
dsacls "OU=Staff,DC=corp,DC=example,DC=com" /R "CORP\Helpdesk"  # remove

Keep the delegated group tightly membership-controlled and off any high-value OUs. A helpdesk that can reset a Domain Admin password is just Domain Admin with extra steps.