Windows Forum

Ask something
Discussion Locked

delegate admin rights on ou

0 helpful
8 replies

by techserf

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Windows 2003 Standard Active Directory:
How can we delegate complete and utter Full Control over an ou for people who are not domain admins?
This group needs to
a. install software on domain controllers (can't do this yet)
b. manage accounts, shares, backups, printers, etc (can do most of this so far)

thx in advance

8 replies

by sgt_shultz

well i am a newbie at this as you can see but don't you have to supply more information about your domain structure for us to answer this? one forest/one tree? one ou? why not give ou domain admin group membership...

by cg it

I don't think you want someone to be able to install software on a domain controller that isnt a network admin. Access to a domain controller by non network admins is tantamount fo suicide. All they have to do is be curious and can muck up the entire network and bring it down.
As far as manage accounts, shares, backups, printers, power users group. they get just enough privilege to do those things but not enough to bring the network down.

by cg it

to delegate control of an organizational units group policy, right click the container and choose delegate control. The wizard will walk you though the steps in selecting users or groups, the tasks they will be able to perform.

by cg it

geez I worded that wrong, to delegate an OU, right click the container and choose delegate control. Follow the Wizards instructions.

by technicalservices

To install software on a domain controller requires the user to be an administrator of the domain controller. The administrator of the domain controller is the administrator of the domain.

You can't get around this.

This discussion is closed to new replies.