Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way to allow a non-administrator to "read" (as in browse and look at the settings) of domain gpo's?

I see in GPMC there is an option to allow delegation of "Read Group Policy Results data" but I'm not solid on whether that will provide the type of access requested. Any input would be appreciated.


share|improve this question

1 Answer 1

up vote 1 down vote accepted

I've check gpo read permissions. I'm use gpmc.msc tool for grant permission. There is a Delegation tab under the each GP object. I think that is the place, where you need to grant permissions.

But by default Authenticated users has read access for all GP objects, i.e. all users in whole AD forest and trusted domains have read access.

share|improve this answer
Thanks. The latter part of your answer is what is what I was looking for. I looked at the delegation option but decided that for this purpose it wasn't a good fit. –  Mitch Mar 4 '10 at 14:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.