Active Directory Domain Services 2008 : Delegate Permissions on a Group Policy Object

Delegate Permissions on a Group Policy Object

Scenario/Problem: You created a GPO and linked it to an OU. You need to provide members of a group the capability to edit the settings in the GPO.

Solution: Delegate the permissions on the GPO.

To delegate permissions on a GPO, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	In the console tree, expand the Group Policy Objects node and select the GPO on which you want delegate permissions.
4.	Click the Delegation tab, shown in Figure 1. Figure 1. The Delegation tab.
5.	Click Add.
6.	In the Select User, Computer, or Group window, type the name of the group to which you want to delegate permissions; then click OK.
7.	On the Add Group or User window, shown in Figure 2, select the permission you want to delegate and click OK. Figure 2. The Add Group or User window.

Modify Delegated Permissions on a Group Policy Object

Scenario/Problem: A group was previously delegated the permission to edit a GPO. You need to also allow the group to modify security on a GPO.

Solution: Modify delegated permissions on a GPO.

To modify delegated permissions on a GPO, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	In the console tree, expand the Group Policy Objects node and select the GPO on which you want to modify delegated permissions.
4.	Click the Delegation tab.
5.	In the details pane, right-click the group for which you want to modify delegated permissions; then select the permission you want to delegate, as shown in Figure 3. Figure 3. Selecting the permission to delegate on a GPO.
6.	Click OK on the confirmation to change permissions.

Remove Delegated Permissions on a Group Policy Object

Scenario/Problem: A group was previously delegated the permission to edit a GPO. This group no longer requires the permissions to edit the GPO.

Solution: Remove delegated permissions on a GPO.

To remove delegated permissions on a GPO, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	In the console tree, expand the Group Policy Objects node and select the GPO on which you want remove delegate permissions.
4.	Click the Delegation tab.
5.	In the details pane, right-click the group for which you want to remove delegated permissions and click Remove.
6.	Click OK on the confirmation to remove the delegated permissions, shown in Figure 4. Figure 4. Removing delegated permissions on a GPO.