<!doctypehtml><meta charset=utf-8><meta content=width=device-width,initial-scale=1.0 name=viewport><link href=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/active-directory-help-desk-delegation.html rel=canonical><title>
   Delegation Overview
  </title><meta content="active directory help desk delegation, ad help desk delegation, active directory delegation, Delegation, delegation active directory, helpdesk reset password,delegation administration,active directory delegation of control, helpdesk technicians active directory, ad helpdesk technicians"name=keyword><meta content="Delegate active directory tasks to helpdesk users/technicians in a secured way using web based Help desk delegation in ADManager Plus. Controlled delegation is attained by allowing helpdesk users to login to the console and perform only delegated tasks."name=Description><link href=https://www.manageengine.com/products/ad-manager/help/toc.css rel=stylesheet><link href=https://www.manageengine.com/products/ad-manager/help/style.css rel=stylesheet><link href=https://www.manageengine.com/products/ad-manager/help/adventnet1.css rel=StyleSheet><script src=https://www.manageengine.com/products/ad-manager/help/jquery.min.js></script><script src=https://www.manageengine.com/products/ad-manager/help/script/toppane.js></script><script src=https://www.manageengine.com/products/ad-manager/help/main.js></script><body><section><div class="n1-top n1-com"><div onload=readfr()><div id=header><div class=help_top_pane><div class="full-scr cpr"><div class="inn-container cpr"><div class=product-logo><a href=https://www.manageengine.com/products/ad-manager/index.html?helpdoc target=_blank> <img alt src=https://www.manageengine.com/products/ad-manager/help/images/admanager-plus.png> </a><h4>Help Document</h4></div><div class=mob-act> </div><ul class=right-menu><li><span> X </span><li><a href=https://www.manageengine.com/products/ad-manager/index.html?helpdoc target=_blank> Home </a><li><a href=https://www.manageengine.com/products/ad-manager/resources.html target=_blank> Resources </a><li><a href=https://www.manageengine.com/products/ad-manager/demo.html?helpdoc target=_blank> Demo </a><li><a href=https://www.manageengine.com/products/ad-manager/get-quote.html?helpdoc target=_blank> Get Quote </a><li><a href=https://www.manageengine.com/products/ad-manager/support.html?helpdoc target=_blank> Support </a><li class=downloadd><a class="btn btn-danger eff-1"href=https://www.manageengine.com/products/ad-manager/download.html?helpdoc target=_blank> Download <span class=nav-dwn-icon>   </span> </a><li style="display: block;"class=getquo><a class="btn btn-danger eff-1"href=https://www.manageengine.com/products/ad-manager/get-quote.html?helpdoc target=_blank> Get Quote <span class=nav-dwn-icon>   </span> </a></ul></div></div></div></div></div></div><div class=n1-body><div class="n1-left n1-com"><div class=main-scroll><div class=scrollbar id=style-5><div class=force-overflow><div><ul class="vertical-menu level-one"id=vMenu></ul><ul class=relPro><li class=hrel>Related Products<li><a href=https://www.manageengine.com/products/active-directory-audit/?admpHelpLhs target=_blank> ADAudit Plus </a> <div><p>Real-time Active Directory Auditing and UBA</p><span> <a href=https://www.manageengine.com/products/active-directory-audit/download.html?admpHelpLhs target=_blank> Download </a> | <a href=https://www.manageengine.com/products/active-directory-audit/demo-form.html?admpHelpLhs target=_blank> Demo </a> </span></div><li><a href=https://www.manageengine.com/products/self-service-password/?admpHelpLhs target=_blank> ADSelfService Plus </a> <div><p>Self-Service Password Management</p><span> <a href=https://www.manageengine.com/products/self-service-password/download.html?admpHelpLhs target=_blank> Download </a> | <a href=https://www.manageengine.com/products/self-service-password/demo-form.html?admpHelpLhs target=_blank> Demo </a> </span></div><li><a href=https://www.manageengine.com/products/eventlog/?admpHelpLhs target=_blank> EventLog Analyzer </a> <div><p>Real-time Log Analysis & Reporting</p><span> <a href=https://www.manageengine.com/products/eventlog/download.html?admpHelpLhs target=_blank> Download </a> | <a href=https://www.manageengine.com/products/eventlog/request-demo.html?admpHelpLhs target=_blank> Demo </a> </span></div><li><a href=https://www.manageengine.com/products/exchange-reports/?admpHelpLhs target=_blank> Exchange Reporter Plus </a> <div><p>Exchange Server Auditing & Reporting</p><span> <a href=https://www.manageengine.com/products/exchange-reports/download.html?admpHelpLhs target=_blank> Download </a> | <a href=https://www.manageengine.com/products/exchange-reports/demo-form.html?admpHelpLhs target=_blank> Demo </a> </span></div><li><a href=https://www.manageengine.com/active-directory-360/?admpHelpLhs target=_blank> AD360 </a> <div><p>Integrated Identity & Access Management</p><span> <a href=https://www.manageengine.com/active-directory-360/download.html?admpHelpLhs target=_blank> Download </a> | <a href=https://www.manageengine.com/active-directory-360/request-demo.html?admpHelpLhs target=_blank> Demo </a> </span></div><li><a href=https://www.manageengine.com/log-management/?admpHelpLhs target=_blank> Log360 </a> <div><p>Comprehensive SIEM and UEBA</p><span> <a href=https://www.manageengine.com/log-management/download.html?admpHelpLhs target=_blank> Download </a> | <a href=https://www.manageengine.com/log-management/demo.html?admpHelpLhs target=_blank> Demo </a> </span></div></ul></div></div></div></div></div><div class=scrollbar id=style5><div><div class="n1-right n1-com"><div class=body><h1>Help Desk delegation</h1><h2 id=What-help-desk-delegation>What is help desk delegation?</h2><p>This feature helps administrators to assign or delegate selected activities to non-administrative desk users. It is recommended to delegate     incipient administrative activities to help desk technicians.<h2 id=Who-help-desk-technician>Who is a help desk Technician?</h2><p>A person who is entitled to perform the operations delegated by the administrator is called help desk technician. These operations can deviate from the regular end user functions with a bias of administrative tasks aimed to increase the productivity and reduce administrator's workload.<h2 id=what-help-desk-role>What is a help desk Role</h2><p>A specific role or a set of roles that are delegated by administrator to a unique non administrative user to perform are called help desk roles.<h2 id=what-ou-based-delegation>What is OU based Delegation?</h2><p>The OU based administration lets the administrator to delegate the tasks with a scope limited to a specific Organizational Unit i.e. help desk users can perform the delegated activities that fall under the purview of the assigned OU. This ensures that the security issues are intact and the delegation runs smooth.<h2>How to create a help desk technician?</h2><p>You can create new help desk technicians in two ways:<ul class=bullul><li>- Using the ' <a href=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/active-directory-help-desk-delegation.html#add-new-technician> add new technicians </a> ' option.<li>- Using the ' <a href=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/active-directory-help-desk-delegation.html#copy-technician> copy technician </a> ' option.</ul><p id=add-new-technician><u> Creating new help desk technicians using the 'add new technicians' option </u><ol><li>Click the <strong> Delegation </strong> tab<li>Click the <strong> Help Desk Technicians </strong> link, and then the  <strong> Add New Technicians </strong> link.<li>Select the desired <strong> domain </strong> .<li>Choose the users, whom you wish to configure as help desk technicians, by clicking the <em> browse </em> button located beside the <em> Select AD User field. </em><li>Select the roles that you wish to delegate to the new technicians by clicking the <em> choose </em> link located beside the <em> Select help desk roles </em> field. (You can <a href=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/active-directory-help-desk-role-creation.html> create customized roles </a> based on your requirements.)<li>Select the desired organizational unit (OUs), if you wish to restrict the scope of the technicians to only specific OUs instead of the entire domain, by clicking the <em> Add OUs </em> link located beside the <em> Select OUs </em> field.<li>Select the <em> Impersonate as Admin </em> option, if you wish to assign admin permissions to the technicians being created.<li>Click the save button to complete the creation of new help desk technicians.</ol><table border=0 cellpadding=0 cellspacing=0 class=note><tbody><tr><td><img src=https://www.manageengine.com/products/ad-manager/help/note.jpg><td><p><strong> Note: </strong></p> <ol class=bollol><li>The <strong> Impersonate as Admin </strong> option elevates the users' permissions only in <strong> ADManager Plus </strong> and does not change their actual settings in <strong> AD </strong> .<li>You can always assign more domains, groups, and also account creation/modification templates to the technicians, by modifying/editing them.</ol></table><p id=copy-technician><u> Creating help desk technicians using 'copy technician option' </u><p>The copy technician option allows you to create new help desk technicians with the same configurations of any existing technicians. By copying the configurations of the desired technician and applying them to the new technicians, administrators can create multiple new technicians with the same configurations.<p>To create a help desk technician using the copy technician feature,<ol class=bollol><li>Click the <strong> Delegation </strong> tab.<li>Click the <strong> <em> <em> Help desk Technicians </em> </em> </strong> link.<li>From the list of existing help desks technicians, locate the technician whose settings you wish to copy.<li>Click the <strong> copy icon </strong> located in the <em> action colum </em> n of the desired help desk technician.<li>In the copy technician window that opens up, select the domain in which the users whom you wish to configure as technicians are located.<li>Click the <em> choose </em> link located beside the <em> Select AD User </em> field, and pick the required users from the ones displayed.<li>Click the <strong> create technicians </strong> button this will configure all the selected users as help desk technicians</ol><h2 id=create-help-desk-role>How to create a help desk role?</h2><p>There are some predefined help desk roles which you can find when you select theHelp Desk Roles link. You can also create new roles to meet your specific requirements.<p>To create a new help desk role:<ol class=bollol><li>Click the Delegation tab<li>Under Help Desk Delegation, click the Help Desk Roles link<li>Click the   <img src=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/images/add-help-desk-user.gif> Create New Role link, to create a new help desk role from the scratch. <em> You can also create a new role by just <a href=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/copy-active-directory-helpdesk-technician-role.html> copying an existing role </a> ; to copy another role, <a href=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/copy-active-directory-helpdesk-technician-role.html> follow these steps </a> . </em><li>In the create help desk role page, enter an appropriate name and description for the new role.<li>From the list of tasks listed under management, reporting and administration, select the tasks that you wish to include in this role.<li>If you wish to prevent a user with this role from using the bulk modification feature or the CSV import option, select the <em> Deny Bulk Modification </em> or <em> Deny CSV Import </em> options respectively.<li>While creating users, if you wish to restrict the access to only specific attributes, use the <em> User Attribute Privileges </em> link located in the 'Create Users' section and select the desired attributes. Similarly, for groups and contacts, use the <em> contact attribute privileges </em> and <em> group attribute privileges </em> options respectively.<li>Similarly, for a more granular selection of the attributes that can be modified/tasks to be included in the role, click the '+' icon located beside each task/action.<li>Click the <em> Save Role </em> button to create the new role.</ol><h2>How to add more than one role/domain to a help desk technician?</h2><ol class=bollol><li>Click Delegation<li>Click on Help desk technicians<li>To modify technician details, click the <img src=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/active-directory-help-desk-delegation_clip_image002.gif>     icon present near the technician's name on the summary page.<li>Enable the required Domains in the Manageable Domains section<li>You can now assign multiple roles by clicking on choose/change for the corresponding domain.<li>You can modify Help Desk Role, OUs and also restrict the user to choose from a selected list of templates.<li>Enable Impersonate as Admin option to allocate admin permissions to the users.<li>Click Save Changes</ol><h2>Help Desk Delegation Flow</h2><p>The core functional theme of Help Desk Delegation is that the technician can login to the ADMP console and perform the functions delegated by Administrator. For this to happen the Administrator should perform the following steps to authorize a help desk technician.<ol class=bollol><li><p class=Numbered>Modify (click on <img src=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/images/modify-help-desk-user.gif> ) or delete (click on <img src=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/images/delete-help-desk-user.gif> ) existing technician or <a href=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/active-directory-help-desk-delegation.html#hdtechnician> create a help desk technician </a></p><li>Select or modify the predefined the help desk roles or <a href=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/active-directory-help-desk-delegation.html#newhdr> create a new help desk role </a> .<li>Define the scope of each operation. Click on the images '+' for <a href=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/active-directory-help-desk-delegation.html#granularauthorization> granular authorization </a> .<li>All the operations can be restricted to a specific OU. More about <a href=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/active-directory-help-desk-delegation.html#ourestricton> OU Restriction </a></ol><h2 id=granular-authorization>Granular Authorization</h2><p>Administrator can restrict the help desk technicians function to a specific part of OU or to specific attributes in a function.<p>Example: Help desk t <strong> echnician </strong> s can be allowed to modify Group attributes at the same time restricting or avoiding them to any of the sub functions like <strong> add to group </strong> or <strong> remove from group </strong> or <strong> set primary group </strong> .<h2 id=ou-restriction>OU Restriction</h2><p>All the functions that are being performed by help desk t <strong> echnician </strong> s can be restricted to specific OU's. This enhances the security of Active Directory by authorization. <h2>Restrict Report Viewing</h2><p>You can restrict the help desk technicians from viewing certain reports and can be imposed at the time of creating the help desk Role. This restriction can be imposed on all of the reports under a particular reports category say like User Reports, Computer Reports, etc., or on specific reports under each of these Report types. The view for those reports whose check boxes have been enabled will be restricted for the help desk Role.<h2 id=enable-disable-help-desk-technicians>Enable/Disable help desk Technician</h2><p>Super Admin can enable/disable one or more help desk technicians based on his discretion. Click on the appropriate Enable or Disable icon adjacent to the respective Technician's name to achieve this operation. This enhances the security of Active Directory by authorization.  <h2 id=multiple-domain-management>Multiple Domain Management using help desk Technician</h2><p>This feature allows the Administrator to allocate Multiple Domain Support for help desk technician (s). The following steps will help perform this operation:<ul class=bullul><li>Select the Delegation tab. <p></p><li>Select the <img src=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/images/modify-help-desk-user.gif> under Action of Help Desk Technicians. This opens the Modify help desk technician Dialog. <p></p><li>Enable the required Domains in the Manageable Domains section.<li>Select the roles for the technician in the new domain.<li>Click on Add OUs link to select the OUs of that domain.<li>Click on Save Changes button to update the changes.</ul><h2 id=group-delegation-help-desk>Delegating Groups for help desk technicians</h2><p>Administrator can associate help desk Technicians with specific groups using the Include/Exclude option of help desk Delegation. The following steps will help perform this operation:<ul class=bullul><li>Select the Delegation tab.<li>Select the <img src=https://www.manageengine.com/products/ad-manager/help/help-desk-delegation/images/modify-help-desk-user.gif> under Action of Help Desk Technicians. This opens the Modify help desk technician Dialog.<li>Click on Add/Remove buttons adjacent to Included Groups to include the required groups for the help desk Technician.<li>Click on Add/Remove buttons adjacent to Excluded Groups to exclude the required groups for the help desk Technician.<li>Click on Save Changes button to update the changes.</ul><p><strong> <em> Note: </em> </strong><ol class=bollol><li>If the Included Groups List is alone mentioned, then the help desk Technician will have permissions only on those mentioned groups.<li>If the Excluded Groups List is alone mentioned, then the help desk Technician will not have permissions on those mentioned groups.<li>If both Included and Excluded columns contain data, then the ones that are unique with respect to Included List will hold good.<li>In case both the lists are empty, then the groups associated with the delegated OUs will be considered.<li>If the 'Include Groups from delegated OUs' option is selected, groups under the 'Included groups' column will be appended along with the existing groups from OUs or Domains that have already been delegated. The groups enlisted under 'Excluded groups' will take higher precedence and be removed.<li>All the OU delegated groups for the technician, get reflected in the report, with restriction for modification only on Excluded groups(that are part of OU delegation).<li>Groups exclusively listed under Include/Exclude groups aren't displayed during report generation.</ol><h2 id=login-sample-help-desk-technician>Login Using Sample help desk Users</h2><p>ADManager Plus offers "Login Options Using Sample help desk Technicians" for first time installations. Two sample help desk Logins will be allocated for HR and help desk, with create and reset password options respectively.<h2 id=help-desk-delegation-help-you>How does help desk delegation help you ?</h2><p>Help Desk delegation helps in disseminating the workload from administrator's desk. It reduces the burden on administrator there by allowing him to concentrate on core administrator activities.<p>It increases the productivity of users by eliminating administrator's intervention in self-manageable activities.<h2 id=scope-delegation>What is the scope of delegation?</h2><p>Administrator can limit the scope of delegated activities according to his wish. He can limit the t <strong style="font-weight: normal;"> echnician </strong> s to a specific organizational units or a part of organizational unit.<h2 id=what-about-security>What about security?</h2><p>Help desk delegation is delivered with a security shield. All the actions performed by help desk technicians will be in the purview defined, enabling security settings intact. To prevent security breach the technicians and their activities are fenced to a specific party of Active Directory and enforced authentication zeroes security pitfalls.<h2 id=use-help-desk-delegation>How to use help desk delegation?</h2><p>For a successful implementation of this feature follow the below steps:<ol class=bollol><li>Select the Delegation tab.<li>Click the Help Desk Technician<li>Select the domain<li>Select the Active Directory user. Click Browse to select user. The selected user will be eligible to perform the roles defined in next steps.<li>Select the role by clicking on 'choose'. This role will be assigned to the user selected. Be cautious in selecting the role. At a time you can delegate only one role to a user.<li>Select the Organizational Unit. This limits the user's role only to that OU.<li>Save.</ol><p><strong> How can help desk technicians modify first name and last name of users? </strong><ul class=bullul><li>Click on AD Mgmt tab<li>Click on Modify Users under CSV import<li>Import the CSV file<li>Select the Users and click on apply.</ul><p>Here is a sample CSV file,<p>sAMAccountName,givenName,sn <br> TestUser,Sample,User<p><strong> Note </strong> : For "sAMAccountName" please provide the existing sAMAccountName of the user and for "givenName" and "sn" please provide the new names (name to be modified).<p>Also, for help desk technician please make sure that "Modify Users" option is selected.<p id=help-desk-implementation-scenario><strong> Help desk Implementation Scenarios </strong><p>HR Department in your organization need not wait for the System Administrator to confirm that the newly joined employees are enrolled in the active directory. Help Desk Delegation allows an administrator to grant rights to the HR People to create new user accounts whenever a person is recruited. This saves time for both the departments and enhances productivity.</div></div></div></div></div></section><script>var $zoho=$zoho || {};$zoho.salesiq = $zoho.salesiq || {widgetcode:"17ecf895f593451acdedb5ca71d27b67f27821d5de9ba7a57353f99e155e9183376a2706e4d3ab0545049cd87c532af3", values:{},ready:function(){}};var d=document;s=d.createElement("script");s.type="text/javascript";s.id="zsiqscript";s.defer=true;s.src="https://salesiq.zoho.com/widget";t=d.getElementsByTagName("script")[0];t.parentNode.insertBefore(s,t);d.write("<div id='zsiqwidget'></div>");
$( ".mob-act" ).click(function(){$( ".right-menu" ).addClass("menushow");}); 
$( "ul.right-menu li:nth-child(1) span" ).click(function(){$( ".right-menu" ).removeClass("menushow");}); 
var loc = document.location+"";
	if(loc.search("https://www.manageengine.com")!==-1){$(".downloadd").show();$(".getquo").hide();
		}
	else{$(".downloadd").hide();$(".getquo").show();}</script><script>$( "ul.relPro li" ).mouseover(function() {
		if($(this).hasClass("hrel"))
			{
	
			}else{
  $( "ul.relPro li div" ).stop(true).slideUp(500);
		$( "ul.relPro li" ).stop(true).css("border","none");
	$("div", this).stop(true).slideDown(500);
		$(this).stop(true).css({"border-top": "solid 1px #f3f3f3", "border-bottom": "solid 1px #f3f3f3"});
			}
});</script><div class=footer>Copyright © 2021, <a href=http://www.zohocorp.com target=_blank> ZOHO Corp. </a> All Rights Reserved.</div>