Tools for Managing AD Delegation

Implementing an Active Directory (AD) delegation model can be daunting. The tools in the following list can help.

• Microsoft Management Console (MMC) Active Directory Users and Computers snap-in. In addition to using standard user, group, and computer account management, you can use this snap-in to manage AD security. By default, AD security control is hidden, but you can enable it by clicking View, Advanced features. After you enable the advanced features, each object will have a Security tab under which you can set permissions. You can configure some basic delegation using the Delegation of Control Wizard, which you also access through this snap-in. After you right-click an OU and select Delegate control, the wizard will walk you through assigning permissions over that OU. This tool doesn't display current permissions or let you revoke previously assigned permissions, so you'll probably find the Security tab more useful in day-to-day permissions administration.
• MMC ADSI Edit snap-in. This tool, which is one of the Windows 2000 Support Tools on the Win2K Installation CD-ROM, lets you access all properties of all objects as well as connect to and administer security over all naming contexts. The ADSI Edit snap-in also attaches a Security tab to all objects. Unlike the Active Directory Users and Computers snap-in, in which certain security attributes are hidden by default, the ADSI Edit snap-in always shows all the security attributes.
• Dsacls. This command-line tool is also installed with the Win2K Support Tools. Just as Cacls lets you set permissions from the command line through the file system, Dsacls helps you set permissions on the directory. Dsacls also displays permissions that you have already applied. Dsacls is a much more efficient tool than the Security tab in the Active Directory Users and Computers snap-in for getting a complete picture of the permissions applied to a given OU.
• Acldiag. Similar to Dsacls (and also one of the Win2K Support Tools), this command-line tool lets you view and set AD permissions. In addition, the tool has a little-known feature that indicates which delegation tasks have been applied through the Delegation of Control Wizard. This feature is handy because the Delegation of Control Wizard doesn't provide any information about previously assigned tasks. In some circumstances, Acldiag can even correct access control entries (ACEs) that differ from the specifications in the task templates.
• Third-party tools. Several third-party tools are available to help you manage your delegation tasks. Aelita's Enterprise Directory Manager, BindView's bv-Admin for Windows 2000, Quest Software's FastLane ActiveRoles, and NetIQ's Directory Security Administrator are some of the most commonly used today.