Hello,

We are trying to do an internal audit to find out how any of our delegated admins can reset the passwords of our CFO's domain user account.

I believe that we can do so by figuring out who effectively has the Reset-Password extended right granted on the CFO's user account object, and so we were trying to determine resultant access on his object.

Unfortunately this process is taking us a long time, so before we invested precious time, I thought I would inquire as to whether there are any other security permissions that we should be taking into account, other than the Reset-Password extended right.

Thank you in advance for your input.

Jeremy.