Printable View
Hello, I have a user which manages an OU. Do I really need to add him to the Group Policy Creator Owners group so that ha can Create, Edit, Delete GPO's in the OU.
If you can explain the difference between the delegation setting of the OU and the delegation setting of the GPO in GPMC would clear things out for me.
Group Policy Creator Owners group allows members to create new GPO. However, members can only edit or delete the GPO you created. Group Policy Creator Owners group also does not have permission to link the GPO to a container such as a domain or OU; that permission has yet to be determined manually. To add a user or group, simply open the Group Policy Creator Owners group, which is in the Domain Users container, and add as needed.
You can simply allow the non admin users or a group in your network to work with your existing domain or site. Also you can add them in OU GPO through specific permission options only. Rightnow you can provide them three kind of different settings. This consist of read settings through which you can let users or group to view the gpo. But they won't have access to edit gpo settings. The second thing you can do is offer them option to edit settings. This is another limited one. Here the user or group is not allowed to delete anything. And the latest one is edit, delete and modify everything.
Delegate Control to Users to Work with GPOs
It is important that you must properly delegate the group policy settings. Or else there can be problem with users or group who had allowed to access your domain. I am giving you a link that give you detail information on Delegating Administration of Group Policy. GPO is a vital component when it comes to manage Windows Server environment. It allow you to have complete control and grant access to others. So here you have the complete power to properly delegate rights. It is essential that when you are working on Admin control you must manage that properly.
Delegating Administration of Group Policy