So let's look at a scenario where we want to delegate the ability for Joe Sales in the sales group to
temporarily be a group policy admin guy.
And Joe Sales needs to be able to create a GPO and link it to the sales users view, which you see here
in PMC.
So right now if I right click on the users oh you as Joe sales you'll see all of these options are grayed
out.
I can't do pretty much anything against this.
So you.
And if I try to come down under the group policy objects container and let's say I want to create a
new GPO.
If I go ahead and say new and I'm going to say Joe Sales, GPO and click okay I get access denied.
So at this point, Joe, Sales can't really do anything from a group policy admin perspective.
So what I'm going to do is I'm going to come over to my Jeep management console running on my Active
Directory domain controller, and I'm going to go ahead and delegate Joe Sales.
The ability to create GPOs.
Now what I actually preferred to do was to delegate it to a group rather than an individual user.
So what I'm going to do instead of that is I'm going to come down here and I'm going to create a new
group and I'm going to call this group sales admins.
And once that group's created, I've got a global group here.
I've created.
I'm going to go ahead and add.
I'm going to add Jos sales to the sales admin group.
So I'm going to go ahead under members and say add Joe to sales admins.
And I'm going to come back to M.C. and I'm going to say add a delegation on the group policy objects
container.
So that sales admins can create GPOs in the domain.
And so now sales admins can create GPOs in this domain.
And if I come down to the sales.
Oh you I want to let sales admins link GPOs to the users.
Oh you under the sales.
Oh you.
So if I come over to delegation here.
I select the link and I add sales admins.
Go ahead and check names on that and grab the right group.
And I can say, do I want it on this container and all child containers?
Well, I don't have any child containers under sales or under users.
But I'm going to go ahead and select this container only just to make sure that it stays that way.
So now the sales admins members can link GPOs to the users container and they can create GPOs.
So let's go back over to our client.
And since I added Joe Sales to a new group, I'm going to have to log out and log back in in order for
that Joe sales membership to take effect.
So I'm going to do that right now.
And now I'm logging back in as Joe Sales.
And this time I'll get my group membership and sales admin for my new session.
Okay.
I'm going to go ahead and Run DMC.
And let's go ahead and go down to the group policy objects container.
And I'm going to say new GPO.
So I'm going to go ahead and create a new GPO called Sales Edmonds, GPO.
And it let me create that GPO.
So there it is.
And if I look at the delegation on the GPO, you'll see that Joe Sales, not the sales admin group,
but Joe Sales has been given full control over that GPO.
So what happened there is that Joe Sales as a member of the sales admin group, created the GPO and
his individual account has been given delegation to the GPO to make changes to it.
So even though there might be another sales admin user, that user is not going to have access to the
GPO that Joe Sales created.
They're not going to be able to make changes to it.
That's an important point to note about delegating access.
Then when I go in under sales users and I'm going to right click and you'll notice that now these options
are not grayed out.
And I can go ahead and say, Lincoln, existing GPO.
And I can link the sales admins GPO and I'm good to go.
Now, one thing to note is if I wanted to try to link to the marketing.
Oh, you.
I still can't do it.
So that's not available to me.
Just because I have access to the sales oyu doesn't mean I have access to the marketing or you.
And in fact, if I go up to the parent level of the sales user review, I can't link there as well.
So only this delegated container can I link to using this permission?
One other thing I want to mention about the commissioning.
Remember that I mentioned that when you're on a container, you can delegate group policy modeling and
group policy results as well.
The group policy results option actually does two things.
The first thing it does is it lets you run as a user.
It lets you run group policy results against computers that are in this for you.
The other thing it does, interestingly enough, is it lets you do remote update.
I introduced this concept in an earlier version.
In an earlier module.
Remote Group Policy Update is a feature on Windows eight dot X and later versions like Windows ten and
Server 2012, where two in Server 2012 or later versions like Server 2022.
And the only way to delegate in other words, control who can do group policy update is to grant them
the seemingly unrelated permission of group policy read group policy results.
So by granting this right, you grant the user both the ability to run RSP against the remote system
and also to do a remote GP update against that remote system.
So just something to keep in mind.
Not well-documented at all, but something that's important to know if you're planning to roll out the
ability to do remote group policy updates.