Delegating Administration of Domains and OUs

When you create domains and OUs, you'll often want to be able to delegate control over them to specific individuals. This is useful if you want to give someone limited administrative privileges for a domain or OU. Before you delegate administration, you should carefully plan the permissions to grant. Ideally, you want to delegate the permissions that will allow a user to perform necessary tasks, while preventing your delegate from performing tasks he or she should not. Often, figuring out the tasks that a user with limited administrative permissions should be able to perform requires talking to the department or office manager or the individual.

Understanding Delegation of Administration

You delegate control of Active Directory objects to grant users permission to manage users, groups, computers, OUs, or other objects stored in Active Directory. You can grant permissions in the following ways:

  • Grant full control over an OU Useful when you have local administrators within departments or at branch offices and you want those individuals to be able to manage all objects in the OU. Among other things, this allows local administrators to create and manage accounts in the OU.

  • Grant full control over specific types of objects in an OU Useful when you have local administrators who should only be able to manage specific types of objects in an OU. For example, you might want local administrators to be able to manage users and groups but not to be able to manage computer accounts.

  • Grant full control over specific types of object in a domain Useful when you want to allow an individual to be able only to manage specific types of objects in a domain. Rather than adding the user as a member of the Administrators group, you grant the user full control over specific objects. For example, you might allow the user to manage user and group accounts in the domain but not to perform other administrative tasks.

  • Grant rights to perform specific tasks Useful when you want to allow an individual to perform a specific task. For example, you might want to allow a department manager to read information related to user accounts in Active Directory Users And Computers or you might want to allow help desk staff to be able to reset user passwords.

When you delegate permissions, it is important to remember how inheritance works in Active Directory. As you may recall from previous discussions of permissions, lower-level objects inherit permissions from top-level objects. In a domain, the top-level object is the domain object itself. This has the following results:

  • Any user designated as an administrator for a domain automatically has full control over the domain.

  • If you grant permissions at the domain level, the user will have those permissions for all OUs in the domain as well.

  • If you grant permissions in a top-level OU, the user will have those permissions for all OUs that are created within the top-level OU.

Delegating Administration

To delegate administration of a domain or OU, follow these steps:

  1. Start Active Directory Users And Computers. Click Start, Programs or All Programs, Administrative Tools, and Active Directory Users And Computers.

  2. Right-click the domain or OU for which you want to delegate administration, and then select Delegate Control. When the Delegation Of Control Wizard starts, click Next.

  3. On the Users Or Groups page shown in Figure 36-14, click Add to display the Select Users, Computers, Or Groups dialog box.

    Select the users and groups for which you want to delegate control.

    Figure 36-14. Select the users and groups for which you want to delegate control.

  4. The default location is the current domain. Click Locations to see a list of the available domains and other resources that you can access. Because of the transitive trusts in Windows Server 2003, you can usually access all the domains in the domain tree or forest.

  5. Type the name of a user or group account in the selected or default domain, and then click Check Names. The options available depend on the number of matches found as follows:

    • When a single match is found, the dialog box is automatically updated as appropriate and the entry is underlined.

    • When no matches are found, you've either entered an incorrect name part or you're working with an incorrect location. Modify the name and try again or click Locations to select a new location.

    • If multiple matches are found, select the name(s) you want to use, and then click OK.

  6. To add additional users or groups, type a semicolon (;), and then repeat this process.

  7. When you click OK, the users and groups are added to the Selected Users And Groups list in the Delegation Of Control Wizard. Click Next to continue.

  8. On the Tasks To Delegate page, select the tasks you want to delegate. As shown in Figure 36-15, a list of common tasks is provided.

    Select the tasks to delegate or choose to create a custom task.

    Figure 36-15. Select the tasks to delegate or choose to create a custom task.

  9. If you want to delegate any of these common tasks, select the tasks. Afterward, click Next, and then click Finish. Skip the remaining steps.

  10. If you want to create a custom task to delegate, choose Create A Custom Task To Delegate, and then click Next. On the Active Directory Object Type page, shown in Figure 36-16, you can now choose to delegate management of all objects in the container or limit the delegation to specific types of objects.

    Select the tasks to delegate or choose to create a custom task.

    Figure 36-16. Select the tasks to delegate or choose to create a custom task.

    On the Permissions page, shown in Figure 36-17, you can select the levels of permissions to delegate for the previously selected objects. You can choose to allow Full Control over the object or objects, or you can delegate very specific permissions.

    Specify the permissions to delegate for the previously selected objects.

    Figure 36-17. Specify the permissions to delegate for the previously selected objects.

  11. Click Next, and then click Finish.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset