Hello! The "userAccountControl" permission should be delegated to allow a user or group to enable/disable a user. But this permission also allows the change of other attributes. There is a permission which only allows enable/disable a user, and does not allow you to change other attributes? Thanks!

Hi, Thanks for the post. Please understand that Account Enabled/Disabled flag is just a part of the "userAccountControl" attribute. As you said, the change of the "userAccountControl" attribute will also cause configuring ALL the bits/flags represented by the "userAccountControl" attribute. You may take the time to check the following article: http://blogs.dirteam.com/blogs/jorge/archive/2006/12/26/_2200_userAccountControl_2200_-attribute-_2D00_-It-can-be-a-pain-to-delegate_2100_.aspx Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information. Thanks, MilesPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks!