If I right click our domain in ADUC console - I see various ACL's and permissions? What is the exact name of the permission for setting up a new domain user account? And are any of the others" high risk" in sensitive environments? Thanks

Hi, To grant management account role in Active directory, the best way is to run delegation wizard in the organizational Unit you want. That's the best recommanded. Any System group or ACL's are sensitive, this is sure. Good luckBest Regards Don't forget to mark it as answer if it helps

Hi, To grant management account role in Active directory, the best way is to run delegation wizard in the organizational Unit you want. That's the best recommanded. Any System group or ACL's are sensitive, this is sure. Good luck Best Regards Don't forget to mark it as answer if it helps Ok so can you tell me in basic steps how to see all users/groups who currently have this management account role? Thanks

Hi, For a single OU you can activate the advanced feature in the view menu, then in this OU, you click on property then security, you search there each group or user that have those permission. If you want to select all group and user automatically that have a specific permission on a specific permission, you must manage that with command line using dsacls. Good luckBest Regards Don't forget to mark it as answer if it helps