Guidelines For Designing The Delegation And Permission Structure For Active Directory Objects

By Author: Shirley Green
Total Articles: 129
Comment this article

Delegation of authority is accomplished by changing permissions on objects in the 220-701 Active Directory. Whether the Delegation of Authority Wizard is used, the permissions are directly modified, or their changes are scripted or hanged in some other fashion, the end result is the same. Neither delegation nor permission structure for Active Directory can be discussed without talking about the other. Therefore use the following guidelines when designing the permission structure and delegation structure for Active Directory objects:
Design the Active Directory OU infrastructure to support delegation of administration of users, computers, and groups.
Delegate authority at the object container level rather than assigning Full Control over the container. Full Control provides too much authority over the container, its current objects, and objects and object types that might be added.
Delegate authority over large object containers such as users, computers, and groups at the object container level rather than doing so at the object container.
For example, delegate ...
... the authority for the Reset Password permission to all users in the free MCSE PDF questions Marketing OU rather than delegating authority over resetting the password to Jeff Smith, a user in the Marketing OU.
Delegate authority to Windows groups, not to individual users.
Delegate authority over logical groups of permissions. For example, delegate authority over the Reset Password and Change Password At Next Logon permissions or over address-related properties of user accounts rather than over address related and account-related properties. (For example, Human Resources might
need the ability to change a user's address and phone number but not to change whether the password should be kept in the account database in reversibly unen-crypted form.)
Train users who will be given elevated privileges because of changes in Active Directory Permissions.
Create custom Microsoft Management Console (MMC) consoles for use by groups that will manage some aspects of Active Directory. Restrict their use of MMC consoles to these consoles.
Assign responsibility for areas of the Active Directory schema, and ensure that all changes to Active Directory object permissions are reviewed.
Document changes that will be made, and keep documentation up to free MCITP PDF questions elate.Test any proposed changes in a test network, not in production.