Delegating Administrative Control

By Author: Mike Jones
Total Articles: 255
Comment this article

You delegate administrative control of domains, OUs, and containers in order to provide other mcp administrators, groups, or users with the ability to manage functions according to their needs. In small organizations, a few administrators might be responsible for managing Active Directory objects. However, larger organizations might require many more administrators, requiring administrators to manage specific domains, OUs, or containers or even specific objects within OUs or containers. To ensure that administrators receive the appropriate permissions, you must delegate the administration of the domain, OU, or container. The Delegation Of Control Wizard is provided to automate and simplify the process of setting administrative permissions for a domain or an OU. Once you've used the Delegation Of Control Wizard to set up permissions, you can view or modify permissions for an object by viewing or modifying the access control entries (ACEs) in the object's ACL.
When you delegate administrative control to users, you must ensure that the users take responsibility and can be held accountable. ...
... Provide training for users who have control of objects. If the users to whom you delegate responsibility are not performing the administrative tasks, you need to assume responsibility for their failure.

By default, all child objects in an get a+ certified online inherit the permissions set on the OU.
Make sure you know the difference between access control and delegating administrative control.
Why shouldn't administrators be assigned to the Administrators group?
Running Windows Server 2003 as an administrator makes the system vulnerable to Trojan horse attacks and other security risks. For most tasks, administrators should be assigned to the Users or Power Users group. To perform administrative-only tasks, administrators should log on as an administrator, perform the task, and then log off.
2.What is the purpose of the Run As program?
The Run As program allows a user to run specific tools and programs with permissions other than those provided by the account with which the user is currently logged on. Therefore, the Run As program can be used to run administrative tools with either local or domain administra?tor rights and permissions while logged on as a normal user.
3.What are the two ways of invoking the Run As Program?
The Run As program can be invoked on the desktop or by using the free practice IT questions Runas command from the command line.