I am attempting to give one of our helpdesk workers the right to unlock user accounts. Currently he is not in any administrative groups that would have this right. I have followed the steps outlined here: http://support.microsoft.com/?kbid=294952Here is my issue. I have delegated him this right at the domain level so it should work no matter where the objects are located within the domain. I can get this to work on user accounts that I have recently created. However he can not unlock any user accounts that were created before I gave him this right. I have copied current user accounts and locked them out and he still can not unlock them. I have tested this out in different OUs.Does anyone have any ideas why he can overwrite newer accounts and not older ones? Regards -PAQERI