Solved

Help - How do I create a OU Admin? But it cannot has rights to the other OU's!

Posted on 2008-10-02
5
345 Views
Last Modified: 2009-01-15
I have Enterprise Admin Rights, and I have many people that want to do things all the time with there own OU. That is OK, but I want to control and have those individual manage there own OU's.

I know, Deligate! and I have read that but how to maintain those boundrys - some similar Active Directory for Dummies explains a little and they are close but far from my requirements above.

Either OU admin's, must not have the rights or power to do anything in each others OU, Except for the OU manger or OU Admin what ever you want to call him...  
0
Comment
Question by:mark_randolph
  • 2
  • 2
5 Comments
 
LVL 5

Expert Comment

by:ostaehr
ID: 22628040
As you said: delegate. Create a global group for an OU and grant some administrative rights on this OU to the group. Put regular users (NOT domain-admins) into this group and you're done. Repeat for each OU.
Yes, this is a bunch of work to do.
0
 
LVL 4

Expert Comment

by:lscapa
ID: 22633798
Continuing ostaehr's comment a little. When your in the delegation wizard just select "custom task" -> This folder, existing objects in this folder and creation" -> Under permissions select "Full Control".
Now this will give that group full control over every object in the OU and any OU underneath this point. If you're wanting ot grant only specific tasks to these individuals then that needs a different approach.
0
 
LVL 1

Author Comment

by:mark_randolph
ID: 22635552
So Iscapa, If I understand you correctly, when you give full control to every object in the OU does that also give you permission to add computers to that OU as well?

Ostaehr - That was so uninformative, next time I would recommend that you provide a little spice with your answers.
I know your trying to help, but please be a little more discriptive.
0
 
LVL 4

Accepted Solution

by:
lscapa earned 500 total points
ID: 22635575
Yes it does. EVERY OBJECT is included with Full Control.
0
 
LVL 1

Author Comment

by:mark_randolph
ID: 22635659
Let me try that, and if it works I will give you the accepted solution provider...
0

Featured Post

Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This article outlines the process to identify and resolve account lockout in an Active Directory environment.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question