Domain Admin rights and views

Posted on 2011-10-21
Last Modified: 2012-05-12
We are migrating our domain to a bigger domain.  currently we have child domain.  The powers that be have taken away my administrator rights and it's a nightmare.  Is there a way for me to be set up on my DC to ONLY SEE my OU so that I can only administer my own OU without seeing or accessing anyone elses?  I thought AD was designed for this.
Question by:WellingtonIS
    LVL 13

    Expert Comment


    Author Comment

    OK let me pass this on.  I'm not understanding it so much but we'll c

    Author Comment

    What does the managed by mean for the OU will that give us rights?
    LVL 9

    Expert Comment

    Right Click the OU in question and select the Delegate Control Option.  There is a wizard that they can go through and select everything that they want you to be able to do:

    LVL 57

    Expert Comment

    by:Mike Kline
    So are you asking to open up ADUC and just see your OU, that you won't get through delegation.  Delegation just delegates rights.

    You can create a taskpad view if you want to see less

    By default authenticated users have read access to most of the directory and that is why you see everything.


    LVL 24

    Accepted Solution

    You can achieve the same by assignning deny permission.On the OU whcih you dont want the user to view the OU go to security setting and add the user with deny pemission.

    Once the deny permission is assigned to user on specific OU the user won't be able to view the OU when he opens Active Directory users and computer.

    I would personally will recommend to use delegation option.If the User is added to admin group remove the same and deleagte control on OU.But this will have atleast read permission on other OUs.

    If you have multiple users who act as admin you can achieve the same as below

    Create a group like "helpdesk admins" then open Active Directory Users & Computers MMC snap-in right click on OU where you want them to give rights, if you want give them rights over whole domain then right click on domain name, select delegate control option.

    In the resulting wizard select the group you created earlier "helpdesk admins" click next then click Create a Custom Task to delegate then click next.Select which tasks the groups will be able to perform.

    Refernce link:


    Author Closing Comment

    sorry it took so long for me to close this.  I'm busy migrating the domain.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Free Trending Threat Insights Every Day

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    I'm sure that every Windows systems administrator has written, or at least used, a batch or VBS login script at some point in their career, whether it is to map network drives, install printers, or set some user preferences.  No more! With Window…
    Do you have users whose passwords are expiring and they are constantly calling you?  Well I sure did and needed a way to put an end to this.  We have a lot of remote users which would not be notified that their passwords were expiring since they wer…
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now