What is difference between OU delegation full control and OU security tab full control


  • We can delegate OU by delegation wizard.

    We can also grant right by OU's security tab.

    Is there any difference ?

    22 iunie 2012 01:11


Toate mesajele

  • Hi,

    In short, there's no difference, the wizard simply makes the process easier for people unfamiliar with which rights perform which function. The end result is the same, which is new access control entries (ACE) are added to the OU.

    You can achieve exactly the same thing through using the security tab, you just need to know which specific rights need to be granted in order to achieve the end result you're chasing.


    22 iunie 2012 02:04
  • Hello,

    no difference at the end. Delegate control wizard makes it easier as you can built your own jobs also to be shown there. Additional you can download some prepared ones from Microsoft.

    If you work on the NTFS permissions you have to know the attributes yourself to change, this is of course more work bbut also lot more detailed settigns are possible.

    Best regards

    Meinolf Weber
    Microsoft MVP - Directory Services
    My Blog:

    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    22 iunie 2012 08:06
  • Hi,

    no, there is no difference between these methods. Both of them are granting Full Control over OU for delegated user/group. If you're interested about task delegation within a domain using different methods, you may visit my blog and read artcile about AD Delegation Control wizard at

    and there are othet articles related with task delegation. If you're interested you may read also them

    Regards, Krzysztof ---- Visit my blog at

    22 iunie 2012 08:39
  • You can delegate control to users/groups etc using delation Control wizard or security permission there is no difference.

    In delegation Control you can use inbuilt template to define the specific permission.However in advance Security tab you need to understand the funtionality of all attributes before you assign the permission.In security permission it may also be the case that you need to select combination of multiple attributes to achieve the same functionality whcih is not required in delgation control.

    For example to create,delete and manage user account you can just select the same in delgation Control Wizard and in security you need to select multiple attributes to achive the same.In short Delegation control is easier and more convenient.

    More on Active Directory Delegation

    Best Regards,

    Sandesh Dubey.

    MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator | My Blog

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    22 iunie 2012 09:19
  • As others have said there is no difference but its matter of comfortableness. If you are aware of which attribute used for what purpose, you can use security tab. Security tab also provides a way to utilize effective permission, auditing on particular attribute but from delegation both are exactly same.

    Awinish Vishwakarma - MVP - Directory Services

    My Blog:

    Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

    22 iunie 2012 09:20
  • There is no difference ...

    Hope it helps __________________________ Best regards Sarang Tinguria MCP, MCSA, MCTS Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    22 iunie 2012 10:06