Active Directory Domain Services 2008 : Delegate Permissions to Link Group Policy Objects

Delegate Permissions to Link Group Policy Objects

Scenario/Problem: A team that has the permission to create GPOs requires the capability to link the GPOs to any OU in the domain.

Solution: Delegate the permission to link GPOs.

To delegate permissions to link GPOs, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	If you want to delegate the permission to link GPOs on the domain level, select the domain node in the console tree.
4.	If you want to delegate the permission to link GPOs on an OU, select the OU in the console tree.
5.	Click the Delegation tab. Ensure that the Permission field contains Link GPOs, as shown in Figure 1. Click Add. Figure 1. The Delegation tab.
6.	On the Select User, Computer, or Group window, enter the name of the group to which you want to delegate the capability to link GPOs and click OK.
7.	On the Add Group or User window, shown in Figure 2, select the inheritance settings and click OK. Figure 2. The Add Group or User window.

Modify Delegated Permissions to Link Group Policy Objects

Scenario/Problem: A team was previously granted the capability to link GPOs at the domain level. They now need this permission at every OU in the domain.

Solution: Modify delegated permissions to link GPOs.

To modify delegated permissions to link GPOs, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	If you want to modify delegated permissions to link GPOs on the domain level, select the domain node in the console tree.
4.	If you want to modify delegated permissions to link GPOs on an OU, select the OU in the console tree.
5.	Click the Delegation tab. Ensure that the Permission field contains Link GPOs.
6.	In the details pane, right-click the group for which you want to modify delegated permissions; then select This container only or This container and children.
7.	Click OK on the confirmation screen to change inheritance, as shown in Figure 3. Figure 3. The confirmation to change inheritance.

Remove Delegated Permissions to Link Group Policy Objects

Scenario/Problem: A team was previously granted the capability to link GPOs at the domain level. They no longer require these permissions.

Solution: Remove delegated permissions to link GPOs.

To remove delegated permissions to link GPOs, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	If you want to remove delegated permissions to link GPOs on the domain level, select the domain node in the console tree.
4.	If you want to remove delegated permissions to link GPOs on an OU, select the OU in the console tree.
5.	Click the Delegation tab. Ensure that the Permission field contains Link GPOs.
6.	In the details pane, right-click the group for which you want to remove delegated permissions and select Remove.
7.	Click OK on the confirmation screen to remove delegated permissions, as shown in Figure 4. Figure 4. The confirmation screen to remove delegated permissions.