Delegate ability to create GPO

[Mark Grace]

Does anyone know the permissions that need to be delegated/granted in order
to create a GPO?

Thanks for the help,

Mark

 

[Brian Desmond [MVP]]

Hi Mark,

If you want the user to have domainwide GPO admin rights, you can add them
to the Group Policy Creator Owners group. Otherwise, right click the OU you
want to delegate in AD Users & Comps, goto delegate control, add the
users/groups you want, and then tickoff Manage Group Policy Links.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Kasper Kari]

Hi

This only gives the right to link an exsisting GPO, not to create one.
Further advice anyone?

/Kasper

 

[Kasper Kari]

It seems that the user should be a member of the group "Group Policy
Creator Owners"

Further reading:

http://www.microsoft.com/technet/tr...r2003/proddocs/deployguide/dmebb_gpu_jtnv.asp

/Kasper

 

[Brian Desmond [MVP]]

Right. This is what I said in my original post. Be aware that it will allow
members to make group policy changes domain-wide.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Kasper Kari]

Hi Brian
You where right, I must train my reading skills

There is a very good guide at this URL:
http://www.microsoft.com/technet/tr...r2003/proddocs/deployguide/dmebb_gpu_jtnv.asp

/Kasper