Active Directory - IT User's & Setting up Restricted Access

Hi All,

OK so here is the scenario:

>>> I am an IT Network / System Administrator for my company - i am responsible for basically everything that happens in the IT department.

>>> our company is expanding, so much so, that i rolled out a new IT Help desk and hired in a few Junior guys with minimal experience to look after the basic stuff, password resets, account modifications, general troubleshooting, and all of the basic low-level stuff you would expect for a level 1 desk.

>>> This desk is only live about 1 month.. so it is VERY fresh - it was setup in a kind of a rush to fit in with the corporate budget and all of the business formalities

>>> So i had a very small amount of time, to get systems in place, all of the basic stuff was covered, there office location, what kind of desks they would have, what PC hardware / software would they need... we got a small office setup.. with a few new, bog standard desktops and i setup some avaya contact center phones to integrate into my existing Microsoft LYNC IP Phone system to get a " call center " experience going... the end user would call an extension, and get a list of VDN options etc.

>>> from an end user prospect, it all works well so far... no big complaints.. but where still in the " teething period " like anything new...

>>> the MAJOR problem at the moment is... the help desk agents we hired, are good guys.. they are all very respectable etc. but there IT knowledge is very junior, and they require a good bit of training...

>> They are a member of most admin groups.. some restrictions apply but not many... the big issue is... they are plane and simple messers.. some of them know a little more IT techy stuff that others.. so they have started to " mess " around in the corporate infra. IE adding themselves into all of the Admin groups under the sun... changing there display names ... basically taking advantage of there access.


I know i can go into Group policy / AD and modify each and every little thing.. but isn't that too time consuming? - to be perfectly honest, ive never had to restrict an IT users access before.. so never actually had this issue..

i basically only want them to:

>> reset passwords ONLY in certain OUs i grant them access to

>> Modify members in certain OUs etc -

for example, i have all the end users under one Primary OU called SITE USERS >> Department >> Floor etc... but then i have separate OUs for special departments like for - Accounts / I.T. / Human Resources / Senior Management ... and then i have separate OUs for offsite locations.. I don't want the Help desk agents to be able to modify there own accounts... so if i put them into a folder called Help desk under the I.T. OU i don't want them to be able to modify that

i also only want them to be able to do certain things.. like only be able to RDP onto certain servers.. perform only certain actions in AD... like i don't want them to be able to delete users... only Mark for deletion in the description.. and disable the user... i only want them to be able to add a certain number of predefined groups to users in AD... like i don't want to be able to add, Mary, the janitor, to the enterprise admin group etc.

i hope you get the idea.. i know i can do most of this in GPOs etc..

but ive never had to do this before.. any opinions, ideas past experiences, or tools, might also be useful.

Robert