Windows Server® 2012 Unleashed

Delegating Control at the Site Level

Control is sometimes delegated at the site level to give network administrators the rights to manage Active Directory replication without giving them the rights to manage any additional Active Directory objects. Site delegation can also do just the opposite, effectively denying network administrators the right to access Active Directory objects on a per-site basis. Specific administrative rights can be granted using the built-in Delegate Control Wizard, whereas others can be set for all the site objects using a site’s group policies.

To delegate control at the site level, follow these steps:

1. Launch Server Manager on a domain controller.

2. Expand the Tools menu and run Active Directory Sites and Services. ...