Active Directory® for Microsoft® Windows® Server 2003 Technical Reference

Planning for the Delegation of Administration

As shown in this chapter, Windows Server 2003 Active Directory provides the tools you need to delegate administrative permissions in your domain. However, with all of the positive things you can do in delegating permissions, you also take the risk of assigning incorrect permissions. Incorrect permissions might mean giving people too many permissions, so that they can do things in Active Directory that they should not be able to do. Incorrect permissions can also mean assigning too few permissions, so that users cannot do the work they need to do. Creating a delegation structure that will provide users with the precise permissions they need requires a significant amount of planning. The following are ...