Delegation of modifying the membership of groups

Hi All,

In our domain, we have an OU called Workstation, under which there are many sub OUs called like DepartmentA, DepartmentB, DepartmentC... Under every sub OU (department OU) there is a group called like GroupA, GroupB or GroupC...

I would like to delegate the permission of modifying the membership of GroupA, GroupB, GroupC, etc. to someone. Is there a short way to manage it? There are too many sub OUs under Workstation OU and thus there are too many groups under each sub OUs. It's too difficult to configure each groups. And I should not grant the access from the Workstation OU level as there are many other groups and sub groups.

Thanks,

July 27th, 2015 11:06pm

Well, you can do that manually by assigning permissions to modifying groups to, say, managers of those groups. You can do that with a PowerShell script (the actual assignment) but I'm not sure that it will be easy to manage afterwards.

An easier way would be to use Adaxes or a similar tool. It allows you to create a virtual query-based OUs that you will include all the members of the groups or the groups themselves (only depends on the query you put in). And then you can just delegate control to that virtual OU to whoever you want (http://www.adaxes.com/tutorials_ActiveDirectoryManagement_ViewAndManageADObjectsCollectively.htm). It's easier to do it that way because if you construct your query correctly, all new added groups will obey the same rules and will be automatically added to the virtual OU and thus you won't need to manually delegate every time. And also you will be able to see who's in charge of what in a single place, which can make management a hell of a lot easier.

Free Windows Admin Tool Kit Click here and download it now
July 28th, 2015 2:20am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics