• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1555
  • Last Modified:

Delegate control of Computers under Active Directory


Is it possible to delegate control of an OU that allows a group to install software and otherwise manage computers in that OU, but not to have any control over user accounts, passwords etc?

We have a native win2k domain and I'm trying to spread our load by allowing a user to install software on all the PC's in his department to save us the job.  I've tried to test by moving a computer account into the appropriate OU then delegated full control of computer objects only to the appropriate user.  It seems to have worked in that he can control that computer account, but he can't install software or do any other admin tasks when logged on to the PC itself.

I presume I've missed a permission somewhere but I'm not sure which one it is.  Can anyone advise please?

I've been generous with the points as a quick answer is required.  Thanks

  • 2
1 Solution
He would need to be a local admin on the machines in his department in order to install software.
Allowing him full control in AD to computer objects only gives him the ability to modify the comptuer object properties, not the computer itself in the sense of being able to install software. From this, he could run computer management and view the event viewer, local users/groups, etc. But in order for a user to install software on a comptuer, they need to be a local admin on that computer.
Yeah, I would suggest making a group like "FinanceAdmins" in active directory, then on all of the computers in finance add the FinanceAdmins group to the local administrators group (just using finance as an example).  Then to give people admin on them just add them to that group in AD.
good idea, i think you need to add financeadmin on each machine one by one, is there any option to do this thru AD, I mean by applying one policy on AD, all machines should take effects.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now