Delegation to edit GPOs
By default, only Domain Admins, Enterprise Admins, or the original GPO creator have access to modify a GPO. Sometimes, you may discover a need to have a junior-level administrator make some tweaks inside a GPO, but perhaps that admin does not have one of these permission levels inside Active Directory. The Delegation tab inside each GPO can be used to enter some additional edit permissions, giving a non-admin or even a group of people the access they need in order to modify a GPO that has already been created.
You can see in the following screenshot that I have opened the Delegation tab of my Accounting Control Panel Settings GPO, where I can view the current permissions for this particular GPO. Using the Add... button, ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access