Mastering Active Directory - Second Edition

Using object ACLs

User or group access permissions to a shared folder are managed by the ACL. Similarly, we can define permissions to AD objects. This can be applied to individual objects or to the AD site/domain/OU, and then the same permissions can be forced onto lower-level objects.

As an example, I have a security group called First Line Engineers, and Liam is a member of this group. Liam is an engineer in the Europe office. In the AD environment, Liam should be allowed to add user objects under any sub-OU that is under the Europe OU. However, he should not be allowed to delete any objects that are under it. Let's see how we can do this using ACLs:

1. Log in to the domain controller as Domain Admin/Enterprise Admin.
2. Review the group membership ...