The task is obviously necessary to complete on your way to implementing Role-Based Administration concept. And, to be honest, being in euphoria after quick acquaintance with AGPM I thought that it was no deal at all: give an account or a group a membership in some special groups including “Group Policy Creator Owners” and voila – you’ve got it. Aha. Like hell it can succeed! =) This darn group is global and thus cannot be populated with objects from other domains. And moreover, you are unable to change the fact: everything is dimmed.
At least I don’t know a way to change the group’s scope (but I noted to myself to find out everything about it). So we won’t get this easy way. Will we retreat? No way. If we can’t add our object to the group, we can create other group and grant permission to the group directly. What permissions does have “Group Policy Creator Owners” group? As far as I know to create any GPO we need permissions in two places: Policies container in AD and Policies folder in sysvol. So let us delegate the permissions for the brand-new group “Role GP Creator Owners”:
1) in AD on Domain/System/Policies container:
I guess, “Create All Child Objects” is a bit overkill, and we can do better (just a guess), but the “Group Policy Creator Owners” group has these permissions, so we won’t do it worse.
2) now on a Policies folder:
That’ll do the job for us. At least at did for me, but still, I recommend to check it with support if you have it. I’ll definitely do that and fix the article if it needs it.
CategoriesAD Apple Beta Books Bug C# Certification CLI Secrets Community DNS DPM Dynamic Access Control Exchange Freebies Fun GPO Happy New Year IE IMHO IPD ISA/TMG MCP Club Microsoft Misc MVP Myths Networking News Office PKI Role Based Administration Scripting Scripting Games Security SSL TechEd Tips'N'Tricks Tools Uncategorized Updates Virtuality Virus Vista Windows 8 Wrap-Up