Re: IMPACT of (Delegation Control of Group Policy) on Active Directory
- From: "Jorge de Almeida Pinto [MVP - DS]" <SubstituteThisWithMyFullNameSeparatedByDots@xxxxxxxxx>
- Date: Sun, 25 Mar 2007 00:14:28 +0100
on specific OUs --> he/she only has impact on whatever is in that OU
on specific AD sites --> he/she only has impact on whatever is in that
site... and that can be ANYTHING like client, servers and even DCs. this one
I would not delegate
I would only allow editing EXISTING GPOs and not allow the creation of GPOs
and linking to whatever
--
Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)
# Jorge de Almeida Pinto # MVP Windows Server - Directory Services
BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
"Tariq Ziad" <TariqZiad@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:038969A1-C152-4E3F-94C7-6C59F0C35548@xxxxxxxxxxxxxxxx
Dear All,
I'd like to ask about the bad effects, impact on the health of active
directory that could result from delegating control of group policy
creation,
editing, linking on OU of Computers and Users OR on Site level to an
engineer
who is only responsible for desktops and laptops (SUPPORT Engineer). I
mean
he is responsible to every thing related to installing OS, Software, and
all
kind of OS and Software settings for users( i.e. on there computers). He
is
not responsible of dealing with any activity related to servers or Active
Directory.
Active Directory is totally managed by a system engineer responsible for
AD,
Exchange, and other print, share and application servers.
Would it harm to delegate control of group policy on OU of computers and
users or on sites to SUPPORT Engineer since his area of responsibility is
desktops and laptops?? Would that have any effect on Servers and AD?
I hope you lead me to Microsoft articles and documents related to this
IMPACT subject.
A small example:
1) if there is an OU that have 10 computer accounts and this SUPPORT
Engineer has delegation of control to create group policies and link them
to
this OU, then how would this harm Active Directory and Domain Controllers.
Also, I mean would creating a GPO and having it appearing in the active
directory even without linking it to any container level (SITE, DOMAIN,
OU),
would that have any harm on the domain container containing it??
2) if there is a site that have computers and servers and this SUPPORT
Engineer has delegation of control to create group policies and link them
to
this Site, then how would this harm Active Directory, Domain Controllers,
and
Servers. How could servers be excluded from any group policy applied on
the
site level, i.e could block inheritance help if these servers are included
in
an OU?
Regards,
Tariq Ziad
.
- Follow-Ups:
- Re: IMPACT of (Delegation Control of Group Policy) on Active Direc
- From: Tariq Ziad
- Re: IMPACT of (Delegation Control of Group Policy) on Active Direc
- Prev by Date: Re: NTFRS 13508
- Next by Date: Re: sysvol replicating to the wrong place??
- Previous by thread: Re: IMPACT of (Delegation Control of Group Policy) on Active Direc
- Next by thread: Re: IMPACT of (Delegation Control of Group Policy) on Active Direc
- Index(es):
Relevant Pages
|
