Almost every place you can click inside the GPMC console has a tab called Delegation. The capabilities provided inside the Delegation tab differ whether you are looking at the properties of a GPO, a GPO Link, the primary Group Policy Objects folder, the root of the domain, the WMI Filters folder, or Starter GPOs. Each entity inside Group Policy has a unique way that permissions can be assigned and delegated.
Inside most Delegation tabs is a button, called Advanced..., that allows you to dig even deeper into specific allowances or blocks that can be performed. If you find yourself tasked with creating a permission that does not appear to be an option on the primary Delegation tab, make sure to check inside ...
