In this video from IT Free Training I will look a delegation of control. Using delegation
in your business allows you to give some administration power to particular users without giving away
the keys to the kingdom so to speak. This video will show you how to use delegation
of control effectively in your Active Directory environment.
Delegation of control comes in handy when you have situations like the following. You
have an office, say in London, that does not have their own support staff. The support
staff are located in New York. Due to the time difference, it is difficult for the New
York IT staff to provide IT support during London’s normal business hours. Things like
password resets and account unlocks you want to be able to give a local user in London
the ability to do this. However, you do not want them to be able to do this for all users
in the domain and you do not want to give them more access than they require.
Delegation of control allows you to do this and the good news is that to set up is just
a matter of running a wizard. As you will see in the demonstration, there is almost
an endless amount of options that can be setup using delegation of control. The most common
tasks that you will most likely configure are reset passwords, manage user accounts,
manage groups, and manage group policy. Without further ado, I will change to my Windows
Server 2008 R2 domain controller and look at how to use delegation.
First of all, I need to open Active Directory Users and Computers. In this example I will
be delegating additional access to the user John Doe for users in the London OU. As shown
here, the user John Doe is located under the New York Users OU. I have done it this way
to demonstrate the user does not need to be in the same OU as the OU that delegation is
being applied to. To delegate control, all you need to do is
right click on the OU you want to delegate control to, in this case the London Users
OU, and select the top option, Delegate Control. This will launch the delegation of control
wizard. Once past the welcome screen, the next screen asks for the user or group that
delegation of control is being configured for, in this case John Doe. I have used a
user account in this example, but in the real world you will most likely use a group so
that if you need to add additional users or change the user that has control, you can
do this easily by changing the members of the group.
On the next screen of the wizard you can decide what tasks you want to delegate to the user
or group. The more common ones are at the top, like “create, delete and manage user
accounts” and “Reset user passwords and force password change at next logon”.
In some cases you may want to give additional access to a service account. For example,
the next option “read all user information” allows the account to read the user attributes
stored in Active Directory. You may running an application that requires this additional
access and delegation of control provides a simple way of doing this.
At the bottom is the option, create a custom task to delegate. If I select this and move
on, this will give me complete control over what I can delegate; the other options on
the previous screen cover common administration tasks.
At the top you have the option “This folder, existing objects in this folder, and creation
of new objects in this folder”. When configuring custom options, you would normally leave this
selected. This will mean that new users and objects and existing objects will have the
permissions chosen for delegation assigned to them.
The next option allows you to configure which type of objects you want to change, for example,
if you had user accounts and computer accounts you could select only user accounts so the
computer accounts would not be affected. In this case I will select the default option
at the top and move on. The next screen allows you to determine which permissions you want
to delegate. They are not all shown by default. When I tick the options to show all the permissions,
you can see that the list of permissions that you can configure is almost endless.
In most cases you will not need that much control, so I will go back in the wizard and
select the option “Reset user passwords and force password change at next logon”.
This will give John Doe the power to change user passwords.
If I press next, notice that I am at the end of the wizard. Once I press finish, delegation
has been given to John Doe to change all the user passwords in the London Users OU. The
wizard is quite straight forward when you select the basic options, but you may be interested
to know, what exactly has been done inside Active Directory to give John Doe this access.
If I right click on the London OU, open the properties for it and then select the security
tab; you will notice that the user John Doe has been added to the list of permissions.
This is what delegation of control effectively does, it is a wizard that simplifies assigning
permissions for common administration tasks. If I look at the permissions John Doe has,
notice at the bottom that special permissions has been ticked. To see which special permissions
have been assigned, press the advanced option, select the user you want to view the permissions
for and press edit. Notice that John Doe has been given the permission,
reset password. The question arises, could this process have been done manually without
using the delegation of control wizard? The answer is yes. Delegation of control simply
makes it easier to configure permissions like these for day to day administration tasks,
but the process could be done manually. I hope you found this video on delegation
of control useful. For more videos on this course and others, please see our web page
or YouTube channel. Thanks for watching and see you next time.