IT staff, using their DOC accounts, can edit Cornell's Active Directory.
Or install Quest and manage it using that tool.