User access only 1 OU group but allow add, delete modify for that OU

All replies

• 

  

  0

  Sign in to vote

  Hi

   Open Active Directory Users and  Computers, select OU(Which you want to allow user to configure), then right click ->select Delegate Control->add user->Select "Create,delete and manage user accounts" & "Create,delete and manage groups" then follow the steps.

  Friday, May 22, 2015 8:53 PM

  Reply

  |

  Quote
• 

  

  1

  Sign in to vote

  Trying to lock down OU for a department, but allow one user to add, delete or modify users and security groups.  Not allow them to see other OUs in AD.

  This is actually a better question for the dedicated WinDS forum (it's not really a GP question at all):
  https://social.technet.microsoft.com/Forums/en-US/home?forum=winserverDS

  You can delegate control of an OU to a user (without granting control to other OUs) as Burak suggests.

  You can't (and shouldn't) disallow a user to "see other OUs in AD"...

  ---

  Don
  (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
  This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

  Sunday, May 24, 2015 2:58 AM

  Reply

  |

  Quote
• 

  

  0

  Sign in to vote

  Hello,

  please see similar thread about this topic:

  https://social.technet.microsoft.com/Forums/en-US/bd87d26d-56bf-44b4-8a44-bf303c46c996/locking-down-ad-users-and-computers-snap-in?forum=winserverDS

  And especially read the parts about risks when doing this wrong!!!

  ---

  Best regards

  Meinolf Weber

  MVP, MCP, MCTS

  Microsoft MVP - Directory Services

  My Blog: http://blogs.msmvps.com/MWeber

  Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

  Twitter:  

  • Proposed as answer by Elaine JingModerator Wednesday, May 27, 2015 1:45 AM
  • Marked as answer by Elaine JingModerator Thursday, May 28, 2015 2:05 AM

  Sunday, May 24, 2015 2:04 PM

  Reply

  |

  Quote