Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to allow a non-administrator to "read" (as in browse and look at the settings) of domain gpo's?

I see in GPMC there is an option to allow delegation of "Read Group Policy Results data" but I'm not solid on whether that will provide the type of access requested. Any input would be appreciated.


share|improve this question
up vote 1 down vote accepted

I've check gpo read permissions. I'm use gpmc.msc tool for grant permission. There is a Delegation tab under the each GP object. I think that is the place, where you need to grant permissions.

But by default Authenticated users has read access for all GP objects, i.e. all users in whole AD forest and trusted domains have read access.

share|improve this answer
Thanks. The latter part of your answer is what is what I was looking for. I looked at the delegation option but decided that for this purpose it wasn't a good fit. – Mitch Mar 4 '10 at 14:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.