Mastering Windows Group Policy

Delegation to create new GPOs

Some of you are skimming over this delegation section, because you assume that anybody who ever needs access to perform these functions inside Group Policy will always have access to a Domain Admin account. While being a member of that group would indeed grant them access to do whatever they need inside Group Policy, let me tell you right now that the days of us having Domain Admin rights are almost over. The ideas of Just-In-Time (JIT) Administration and Just-Enough Administration (JEA) are gaining popularity, necessarily so because Domain Admin rights are simply too broad and powerful these days. Stolen Domain Admin credentials could certainly turn out to be detrimental to your business, as would the case of ...