"Group Policy Owners Group" question ?

Discussion in 'Active Directory' started by Thomas C.R (DK), Nov 8, 2005.

  1. Hi

    I have put a user in the "Group Policy Owners Group" but the user is not
    granted the rights to administere GPO's why ? should the user be put in other
    groups to get this working ?

    I know it works with the domain group, but I do not want the user getting
    this right ;-)

    --
    Best Regards
    Thomas C.R. (DK)
     
    Thomas C.R (DK), Nov 8, 2005
    #1
    1. Advertising

  2. GPO Creator Owner allows you to create and modify GPOs.
    --
    http://www.microsoft.com/technet/pr...elp/4f8dd800-e0e3-44a6-8a4a-d3d34b245fe7.mspx


    To modify other GPOs, you need the edit permission:
    --
    http://www.microsoft.com/technet/pr...elp/4f8dd800-e0e3-44a6-8a4a-d3d34b245fe7.mspx


    Here's some more info.:
    --
    http://www.microsoft.com/technet/pr...elp/53769684-2a36-46b2-8fd9-ae009b58306f.mspx

    --
    Paul Williams
    Microsoft MVP - Windows Server - Directory Services
    http://www.msresource.net | http://forums.msresource.net
     
    Paul Williams [MVP], Nov 19, 2005
    #2
    1. Advertising

  3. Hi

    I am not quite sure, all the documentation I have read, the group "Group
    Policy Create Owners" should have access to modify policyes, but not I my
    domain !?

    What should I change, to get this working as the documentation says should
    be default ?
    --
    Best Regards
    Thomas C.R. (DK)


    "Paul Williams [MVP]" wrote:

    > GPO Creator Owner allows you to create and modify GPOs.
    > --
    > http://www.microsoft.com/technet/pr...elp/4f8dd800-e0e3-44a6-8a4a-d3d34b245fe7.mspx
    >
    >
    > To modify other GPOs, you need the edit permission:
    > --
    > http://www.microsoft.com/technet/pr...elp/4f8dd800-e0e3-44a6-8a4a-d3d34b245fe7.mspx
    >
    >
    > Here's some more info.:
    > --
    > http://www.microsoft.com/technet/pr...elp/53769684-2a36-46b2-8fd9-ae009b58306f.mspx
    >
    > --
    > Paul Williams
    > Microsoft MVP - Windows Server - Directory Services
    > http://www.msresource.net | http://forums.msresource.net
    >
    >
    >
     
    Thomas C.R (DK), Nov 27, 2005
    #3
  4. If the group doesn't have permissions to modify the GPOs, you can grant it
    edit permissions. You can either do this on a per-GPO basis, by modifying
    the DACL of the GPO in question, or you can modify the permissions on
    CN=Policies, CN=System, DC=domain-name, DC=com. The former can be
    accomplished using GPMC, DSA.MSC, ADSIEdit.msc, etc. The latter DSA.MSC or
    ADSIEdit.msc (or any command line tool, LDP or script for both of course).

    --
    Paul Williams
    Microsoft MVP - Windows Server - Directory Services
    http://www.msresource.net | http://forums.msresource.net
     
    Paul Williams [MVP], Nov 28, 2005
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Betatesterzz

    Dual boot system question and family deal discount question

    Betatesterzz, Jan 31, 2007, in forum: Windows Vista General Discussion
    Replies:
    2
    Views:
    492
    Mark S-123
    Jan 31, 2007
  2. pedro g

    vista genral question and ultimate question

    pedro g, Feb 9, 2007, in forum: Windows Vista General Discussion
    Replies:
    7
    Views:
    461
  3. Florida Gal :)

    Defrag Question & System Restore Question

    Florida Gal :), Nov 13, 2004, in forum: Windows Update
    Replies:
    4
    Views:
    243
    Florida Gal :)
    Nov 23, 2004
  4. jj
    Replies:
    0
    Views:
    182
  5. CRIS HANNA \(SBS-MVP\)

    Re: Multi nic question and WINS question w/sbs2003

    CRIS HANNA \(SBS-MVP\), Jul 21, 2004, in forum: Windows Small Business Server
    Replies:
    7
    Views:
    191
    Javier Gomez [SBS MVP]
    Jul 22, 2004
Loading...

Share This Page