This is, as with many of my other posts, mainly a reminder to myself to remember something cool I once stumbled across. More than once I have had to search high and low to remember this site, it is cool but not something you need every day. This site offers many different server, user and other management solutions, common for all is that they are integrated as webserver services – thus you can delegate management (Provision) assignments (server management, user management, self service and what not) to AD users without escalating their AD rights..  An example, you can assign “Joe the plumber” (a regular Domain User) rights to reset passwords for all the other Plumbers in his department – thus freeing help-desk personnel to do more important assignments. How it works, well it’s fairly simple actually – the solution/product run on a web-server, here a service account has “Domain Admin” rights (or lower if required) and can thus perform the various tasks that users ask it to do via the web-interface – the solution/product (web-application) then manages who can do what and furthermore logs all that is done and by whom. The site offer several 30 day free evaluation versions some of which will even work as free versions (limitations apply) after the 30 days. The solutions are used by numerous large companies (NASA, Sony and GE Capital just to mention a few) so it cannot be completely off. See more here; http://www.manageengine.com/products/ad-manager/index.html Other tools in the same product range; http://www.quest.com/active-directory/ A YouTube web-cast of Quest’s solution (1 hour); A YouTube video intro to AD Manager Plus (not super good nor official, but it may give you some idea); Microsoft is also about to release solutions that can perform some of these tasks; http://www.microsoft.com/systemcenter/en/us/service-manager/sm-end-user.aspx http://www.microsoft.com/systemcenter/en/us/essentials/sce-overview.aspx