The Active Directory Delegation of Control Wizard

The following example shows how to use the wizard to distribute management tasks for a fictitious paper company called Wildwood. Wildwood has 500 employees spread among its Denver headquarters and two branch offices. The Boston and Chicago branches each employ a local IT staff responsible for user and network management. You want to completely delegate user and group account management and group policy links to the branch offices' local staff, while retaining the ability to manage the branch networks when the local managers are out of the office. The Chicago operation is acquiring subsidiaries, so you want to empower the Chicago IT staff to create new OUs. However, you don't want the IT staff in the branch offices to have any administrative authority over the headquarters operation.

Because Wildwood has only 500 employees, you can manage the organization with one domain, which I'll call WildwoodA. To delegate control to the remote locations, you need one OU for each office, which you call the Boston Branch Office and the Chicago Branch Office. You also must create in each OU local user and computer accounts, server accounts, and an administrative group that contains the local IT staff. Then, you can delegate control of each OU to that OU's administrative group. Figure 1 shows the Active Directory Users and Computers display of the OUs and their user, computer, and group members.

To delegate full control of the Boston OU to the Boston Administrators group, which has two members, Roger Barrington and Sally Sorba, you need to run the Delegation of Control Wizard. In the Active Directory Users and Computers display, right-click Boston Branch Office, and click Delegate Control, the first entry on the context-sensitive menu. Click Next on the resulting Delegation of Control Wizard Welcome screen to begin the delegation procedure. This action brings up the Users or Groups window. (The Selected users and groups portion of this window is always empty, even if you have previously delegated control to this OU. This blank area is disconcerting the first few times you experiment with delegation.)

Click Add to display the Select Users, Computers, or Groups window, which Figure 2 shows. In this window, you can select users and groups from the entire directory, the active domain, or another domain (including Windows NT 4.0 domains) from the Look in drop-down box. Because you have only one domain, the contents of the directory and the domain are identical. Next, double-click the Boston Administrators group. If you want to delegate control of the OU to multiple groups or groups and individuals, you can select multiple entries from the directory or domain display by double-clicking each entry. The wizard displays each selection in the lower portion of the screen. Click OK to proceed, and verify your selections in the previously blank area of the Users or Groups window.

When you click Next, the wizard displays the Tasks to Delegate window, which Figure 3 shows. The Delegate the following common tasks option is enabled by default. You want to delegate control of user and group accounts to Boston Administrators, so you need to select all six options in the common tasks list: Create, delete, and manage user accounts; Reset passwords on user accounts; Read all user information; Create, delete, and manage groups; Modify the membership of a group; and Manage Group Policy links. If you want to delegate only limited control to the Boston IT staff, you might select only the Reset passwords on user accounts and Read all user information check boxes.

If the common task list doesn't include the task you want to delegate, select the Create a custom task to delegate option, which displays two options. If you select the first option, This folder, existing objects in this folder, and creation of new objects in this folder, you're delegating full authority to manage everything the folder contains as well as the right to create any new object within the folder. If you want to delegate only some of these tasks, select the Only the following objects in the folder option, and select a subset of objects from the list. To delegate management of printers and shared folders in an OU, select only these objects from the list and click Next. In the resulting Permissions window, which Figure 4 shows, you identify how your delegates can manipulate printers and shared folders. To delegate management without permitting the delegates to create subfolders, select the Read, Write, Read All Properties, and Write All Properties check boxes.

Click Next. The resulting Completing the Delegation Control Wizard screen presents a summary of your selections. If everything is correct, click Finish. If you selected the wrong group or forgot to delegate a required common task, click Back to correct your mistakes.

Checking the Wizard's Work
When you finish using the Delegation of Control Wizard, you return automatically to the Active Directory Users and Computers window. To double-check the ACL entries for the Boston OU, you must first enable Advanced Features on the View menu; otherwise, you can't display object security controls. Right-click Boston Branch Office, click Properties, then click the Security tab to display the OU's properties, which Figure 5 shows. Boston Administrators appears as the third entry in the Name list. When you highlight an entry in the Name list, the Permissions section shows the permissions that group has for the Boston OU.

When you highlight the Boston Administrators group, no check marks appear in the permissions list. To see the ACEs that the wizard placed in the OU's ACL, you must click Advanced. Figure 6 shows the Permissions tab of the Access Control Settings for the Boston Branch Office window.

You can double-click an entry to display more information about it (or select the ACE and click View/Edit). If you double-click the first entry, you see that the Boston Administrators group has permission to Read gPOptions (Group Policy options) and Write gPOptions, as Figure 7 shows. If you double-click the second entry, you see that the Boston Administrators group has permission to Read gPLink (Group Policy link) and Write gPLink.

These four permissions (i.e., to read and write group policy options and group policy links) are available for the OU object, so the Delegation of Control Wizard could write one ACE that allows all four options instead of writing two ACEs with two options each. When you're comfortable with object security, you can modify the permission settings by manually selecting the Allow or Deny check boxes. And you can combine these group policy ACEs into one ACE if you always want to delegate both tasks in one assignment.

Double-clicking the third entry in the Access Control Settings for Boston Branch Office window brings up the Object tab of the Permission Entry for Boston Branch Office window, which Figure 8 shows. This tab shows that you've granted Boston Administrators Full Control of all group objects, including the ability to create child groups for existing groups. The fourth entry lets the Boston Administrators group create and delete new group objects within the OU. The fifth ACE grants Full Control of existing user objects, and the sixth entry lets the Boston Administrators group create and delete new user objects.

Testing and Modifying Delegations
To verify that your delegates can perform their assigned tasks, log on as a member of the Boston Administrators group. Start the Active Directory Users and Computers utility, right-click the Boston Branch Office OU, click New, then click User. If the New Object-User dialog box appears, the group can successfully create new user accounts. Repeat this procedure for New Object-Groups, and verify that group members can perform all the tasks that you delegated in the Delegation of Control Wizard's common tasks list.

Although the Delegation of Control Wizard grants users and groups administrative privileges over containers and the objects within them, the wizard can't undo delegations. To remove or modify delegations that you created with the wizard, you must manually edit all the relevant ACEs. If you run the wizard again on the same object and change the group or the tasks you previously delegated and you don't modify the ACEs, the wizard will show all the entries from the previous wizard invocation as well as the entries you just created. If you just want to change the delegation status of a few tasks for an OU, modifying the existing ACEs might be easier than deleting the old ACEs and adding new ones with the wizard.

When you examine an OU's ACEs, some entries look like duplicates. Before you delete what appears to be a duplicate, display the Advanced information. The Advanced view might show that the permissions appear identical but apply to different objects. After you manually modify an OU's ACEs, verify that group members can successfully perform all delegated tasks.

Wizard Weaknesses
The Delegation of Control Wizard is a fast and effective tool for delegating routine tasks without having to learn the complex details of AD object permissions. However, to be a comprehensive utility, the wizard should support revocation of delegated authority. If Microsoft doesn't add this support, the company should at least expand the Security tab on the OU Properties dialog box so that you can view each ACE fully without having to scroll left or right or adjust the columns. I also would like to see a document that explains each object permission for custom tasks. Without a thorough understanding of each permission, configuring a custom task is a big challenge.