Windows 2000 Server SP4
Dual 2.8 Ghz Xeon
1GB RAM

I am trying to delegate some tasks to my new help desk contractors but I am having some issues. I added all of my people to a Help Desk security group, assigned them Read all properties, Change Password, and Reset Password abilities on the OU's they need access to, let it replicate to both DC's. When I run a test under one of the users I get "Windows cannot complete the password change for <user> because: Access Denied". I doulbe and triple checked that this group is receiving the proper rights but it will not work. Anyone have some insight?? Thanks.

Create a new custom security group with a
new name for the help deskers and then
delete them from the old group you had them
in and recreate them under the new security
group and set their initial passwords for
them. Make sure you are logged into console
on the primary DC when you do so.

Instead of deleting and recreating each user you may just want to use 'move to' to save time.

Wizard ICT. Microsoft Certified Professional