Mastering Active Directory

Using object ACLs

User or group access and permissions to a shared folder are controlled by the ACL. Similarly, we can define permissions to Active Directory objects. This can be applied to the individual object or the AD site/domain/OU and then inherit to lower-level objects.

As an example, I have a security group called First Line Engineers, and Liam is a member of this group. Liam is an engineer in the Europe office. In the Active Directory environment, he should allow to add user objects under any sub-OU in the Europe OU. But he should not be allowed to delete any object under it. Let's look at how we can do this using ACLs:

1. Log in to the domain controller as Domain Admin/Enterprise Admin.
2. Review the group membership using the following ...