permissions

  • Thread starter Thread starter Mark Berretta
  • Start date Start date
M

Mark Berretta

Hi,

I am in an active directory environment. I need to give a few users the
ability to add security permissions to folders. What is the best way to do
this? Should I create a group called teachers then add account operators to
teachers. Then give teachers full permissions to the folders? Now that they
are Account Operators does this mean they can delete accounts? Did I just
open the door for them to destroy AD?

Thanks,
Mark
 
Create an OU (organizational unit) and a new group to assemble the users
you want to delegate responsabilities to. Create the shares you want to give
the teachers admin permissions to. Move or create these shares in the
aforementioned OU. You can place the teachers group in the OU. Same goes for
printers or whatever other object you want to delegate rights to.
You can then run the Delegation of Control Wizard to delegate rights on
the OU container.
http://www.microsoft.com/windows2000/techinfo/planning/activedirectory/deleg
steps.asp

You can also modify the Group Policy Object ascociated with OU through AD
users and computers.

HOW TO: Delegate Authority for Editing a Group Policy Object (GPO)
http://support.microsoft.com:80/support/kb/articles/Q221/5/77.ASP
 
Back
Top