So now I want to talk about group policy.
Delegation.
And more specifically, group policy management delegation, because we're going to talk about more
than just delegating access to GPOs here.
So in terms of group policy management, what actually can be delegated?
Well, there's actually quite a bit.
In the AMC, you can get access to quite a granular security model.
So GPIO creation can be delegated, GPIO editing, of course, GPIO linking.
So who can link to which all use sites and domains?
The ability to perform result instead of policy modeling, which is something we haven't talked about
yet.
We've talked about RSP logging, which is also called group policy results.
But both of those operations can be delegated so you can control who can do which of those operations.
WMI filter creation and editing.
And starter GPO creation.
And I haven't yet introduced the concept of starter GPOs, which I'm about to do in this module.
So we'll wait on that section to talk a little bit more about what a starter GPO is.
But these are all the operations that you can delegate.
Now in terms of where you do this within the ANC, most of this stuff is accessible through the ANC.
In fact, all of it that I'm going to talk about is accessible through the AMC.
And what I'll say is that when it comes to delegating, doing delegation operations against group policy
stuff, your best bet is to do it through the PMC rather than trying to figure out how to do it against
native Active Directory objects or permissions.
And the reason I say that is because I've seen some folks try to work around the PMC model by delegating
under the covers using Active Directory directly, and GP doesn't always respond well to that unless
you've done it really consistently across the board.
So using EMC to do delegation is your best bet.
And in this case, if I right click on the group policy objects node, I can delegate the right to create
GPOs in this domain.
And as you'll note here, the Domain Admins Group, a special group called Group Policy Creator Owners.
And the local system account have this right today or have this right by default in the domain.
So these are the groups that can create GPOs by default.
So with respect to delegating the linking of GPOs to containers or RSP modeling and logging on computers
in those containers.
If you right click on a container as you can see in this diagram, I'm right clicking on the client
so you and heading the delegation tab and I get a dropdown list of things that I can delegate.
And what this means is for each of these permissions link GPOs perform group policy modeling analysis
and read results data.
I can delegate to different groups of folks.
So I can delegate who can link GPOs to this client.
So you.
I can delegate who can perform group policy modeling against computers in this OAU or who can perform
group policy results of group policy logging to computers in the so you so you can set this either at
the EU level or at the domain level or even at the site level.
You can set each of these rights for linking group policy modeling and group policy results.
In terms of delegating who can edit GPOs?
Once a GPO has been created, you can click the GPO under the group Policy Objects Container.
And on the delegation tab you can control who can read the GPO, who can edit settings, delete or modify
security.
And that permission is actually granting the user the ability to modify the delegation of the GPO itself.
Or you can just grant the edit settings permission, in which case they'll be able to edit the GPO,
but they won't be able to delete or modify security on the GPO.
Now with W my filters, if you click on the W my filters container, you'll have the delegation tab
available to you and you can delegate who can create and edit GOP or sorry WMD filters in this domain
and similarly with starter GPOs.
If you've enabled starter GPOs in your domain, you can use the delegation tab to enable who can create
starter GPOs in the environment.
So you get all of these delegation capabilities within AMC and the ability to delegated a very fine
grained level who can create, edit, link, reposition, create WMI filters, all sorts of activities
related to group policy management.
So let's dive in and take a look at some of this in my test system here.