Solved

Help - How do I create a OU Admin? But it cannot has rights to the other OU's!

Posted on 2008-10-02
5
339 Views
Last Modified: 2009-01-15
I have Enterprise Admin Rights, and I have many people that want to do things all the time with there own OU. That is OK, but I want to control and have those individual manage there own OU's.

I know, Deligate! and I have read that but how to maintain those boundrys - some similar Active Directory for Dummies explains a little and they are close but far from my requirements above.

Either OU admin's, must not have the rights or power to do anything in each others OU, Except for the OU manger or OU Admin what ever you want to call him...  
0
Comment
Question by:mark_randolph
  • 2
  • 2
5 Comments
 
LVL 5

Expert Comment

by:ostaehr
ID: 22628040
As you said: delegate. Create a global group for an OU and grant some administrative rights on this OU to the group. Put regular users (NOT domain-admins) into this group and you're done. Repeat for each OU.
Yes, this is a bunch of work to do.
0
 
LVL 4

Expert Comment

by:lscapa
ID: 22633798
Continuing ostaehr's comment a little. When your in the delegation wizard just select "custom task" -> This folder, existing objects in this folder and creation" -> Under permissions select "Full Control".
Now this will give that group full control over every object in the OU and any OU underneath this point. If you're wanting ot grant only specific tasks to these individuals then that needs a different approach.
0
 
LVL 1

Author Comment

by:mark_randolph
ID: 22635552
So Iscapa, If I understand you correctly, when you give full control to every object in the OU does that also give you permission to add computers to that OU as well?

Ostaehr - That was so uninformative, next time I would recommend that you provide a little spice with your answers.
I know your trying to help, but please be a little more discriptive.
0
 
LVL 4

Accepted Solution

by:
lscapa earned 500 total points
ID: 22635575
Yes it does. EVERY OBJECT is included with Full Control.
0
 
LVL 1

Author Comment

by:mark_randolph
ID: 22635659
Let me try that, and if it works I will give you the accepted solution provider...
0

Join & Write a Comment

[b]Ok so now I will show you how to add a user name to the description at login. [/b] First connect to your DC (Domain Controller / Active Directory Server) SET PERMISSIONS FOR SCRIPT TO UPDATE COMPUTER DESCRIPTION TO USERNAME 1. Open Active …
INTRODUCTION The purpose of this document is to demonstrate the Installation and configuration of the Data Protection Manager product. Note that this demonstration was prepared on the basis of Windows OS is 2008 R2 and DPM 2010. DATA PROTECTI…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now