To work with Group Policy, the Group Policy Management Console (GPMC) should be your tool of choice. Not only does the GPMC provide a fairly intuitive interface for working with Group Policy, but it also provides an extended feature set, allowing you to do more with Group Policy than if you use the standard Group Policy Object Editor. When you work with the GPMC, the console connects by default to the PDC Emulator for your logon domain. This configuration ensures that there is a central location for managing changes to Group Policy. If the PDC Emulator is unavailable for any reason, you can choose the domain controller to which you will connect. You can also set the domain controller focus manually if necessary.

Generally speaking, Group Policy can be managed by members of the Domain Admins and Enterprise Admins groups. However, sites can be managed only by Enterprise Admins and forest root Domain Admins. Domains and OUs can be managed only by Enterprise Admins, Domain Admins, and those who have been delegated permissions. You can delegate privileges for Group Policy management in a few ways. First, you can assign GPO creation rights to users or groups. These users or groups can also manage the GPOs they’ve created. Second, you can delegate permission to link GPOs and work with Resultant Set of Policy (RSoP). Finally, you can delegate permission to read, edit settings, delete, and modify the security of GPOs.