Microsoft® Windows® Group Policy Guide

Delegating Privileges for Group Policy Management

In Active Directory, administrators are automatically granted permissions for performing different Group Policy management tasks. Other individuals can be granted such permissions through delegation. In Active Directory, you delegate Group Policy management permissions for very specific reasons. You delegate to allow a user who is not a member of Enterprise Admins or Domain Admins to perform any or all of the following tasks:

• View settings, change settings, delete a GPO, and modify security

• Manage links to existing GPOs or generate RSoP

• Create GPOs (and therefore also be able to manage any GPOs she has created)

The sections that follow explain how you can determine who has these permissions and how ...