Re: What is the Minimum OU ACE Required to Apply a Group Policy?



Hi

Check if it helps:
Delegation and policy-related permissions
http://technet2.microsoft.com/WindowsServer/en/Library/53769684-2a36-46b2-8fd9-ae009b58306f1033.mspx?mfr=true


--
I hope that the information above helps you

Good Luck
Jorge Silva
MCSA
Systems Administrator

"SMS_Wannabe" <SMSWannabe@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:794F3EAF-60EC-4D6E-B8F3-340444AA5C9A@xxxxxxxxxxxxxxxx
We have an Active Directory in List Object Mode to control who can view
specific objects. When working with list object mode, does anyone know
the
absolute minimum OU permissions a user needs in order to apply a group
policy
that is linked to that OU? When the user only has "List Object"
permissions,
he/she does not apply the group policies linked to the OU; however, if the
user has "List Object" AND "Read All Properties" the group policy is
applied.


"Read All Properties" is more access then we would like to give the users
to
this particular OU, so we are trying to find the actual permissions to the
properties of the OU that are required. I thought it would be enough to
give
the user "Read gPLink" permissions; however, that does not seem to be
enough.

Any guidance is appreciated.



.



Relevant Pages

  • Re: Exchange Hosting - Address Book Problems
    ... Authenticated Users - Deny List contents and List Object ... Permissions, List contents, Read properties, list object, Open address ... They are able to resolve names to the Outlook client. ...
    (microsoft.public.exchange.admin)
  • Exchange Hosting - Address Book Problems
    ... Authenticated Users - Deny List contents and List Object ... Permissions, List contents, Read properties, list object, Open address ... They are able to resolve names to the Outlook client. ...
    (microsoft.public.exchange.admin)
  • Re: OU Permissions for GPO
    ... > permissions on new OU. ... Just remove the Authenticated users ACE from the ... > OUs and grant the proper group list object and read all properties rights ...
    (microsoft.public.windows.server.active_directory)
  • Re: Edit MS Active Directory
    ... Systems Administrator ... Author of O'Reilly Active Directory Third Edition ... permissions on office network and want to remove the admin permissions ... What I need to do is to allow Helpdesk Team ability to logon and have ...
    (microsoft.public.windows.server.active_directory)
  • Granting Permissions to Manage Virtual Directories
    ... in IIS using the Computer Management MMC snap-in. ... Are there certain permissions that my systems administrator could ...
    (microsoft.public.win2000.security)