"Group Policy Owners Group" question ?

Hi

I have put a user in the "Group Policy Owners Group" but the user is not
granted the rights to administere GPO's why ? should the user be put in other
groups to get this working ?

I know it works with the domain group, but I do not want the user getting
this right ;-)

--
Best Regards
Thomas C.R. (DK)

GPO Creator Owner allows you to create and modify GPOs.
--
http://www.microsoft.com/technet/pro...34b245fe7.mspx


To modify other GPOs, you need the edit permission:
--
http://www.microsoft.com/technet/pro...34b245fe7.mspx


Here's some more info.:
--
http://www.microsoft.com/technet/pro...09b58306f.mspx

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net

Hi

I am not quite sure, all the documentation I have read, the group "Group
Policy Create Owners" should have access to modify policyes, but not I my
domain !?

What should I change, to get this working as the documentation says should
be default ?
--
Best Regards
Thomas C.R. (DK)


"Paul Williams [MVP]" wrote:

> GPO Creator Owner allows you to create and modify GPOs.
> --
> http://www.microsoft.com/technet/pro...34b245fe7.mspx
>
>
> To modify other GPOs, you need the edit permission:
> --
> http://www.microsoft.com/technet/pro...34b245fe7.mspx
>
>
> Here's some more info.:
> --
> http://www.microsoft.com/technet/pro...09b58306f.mspx
>
> --
> Paul Williams
> Microsoft MVP - Windows Server - Directory Services
> http://www.msresource.net | http://forums.msresource.net
>
>
>

If the group doesn't have permissions to modify the GPOs, you can grant it
edit permissions. You can either do this on a per-GPO basis, by modifying
the DACL of the GPO in question, or you can modify the permissions on
CN=Policies, CN=System, DC=domain-name, DC=com. The former can be
accomplished using GPMC, DSA.MSC, ADSIEdit.msc, etc. The latter DSA.MSC or
ADSIEdit.msc (or any command line tool, LDP or script for both of course).

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net