Delegation to edit GPOs

By default, only Domain Admins, Enterprise Admins, or the original GPO creator have access to modify a GPO. Sometimes, you may discover a need to have a junior-level administrator make some tweaks inside a GPO, but perhaps that admin does not have one of these permission levels inside Active Directory. The Delegation tab inside each GPO can be used to enter some additional edit permissions, giving a non-admin or even a group of people the access they need in order to modify a GPO that has already been created.

You can see in the following screenshot that I have opened the Delegation tab of my Accounting Control Panel Settings GPO, where I can view the current permissions for this particular GPO. Using the Add... button, ...

Get Mastering Windows Group Policy now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.