Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to delegate an AD user to administer the Group Membership of certain groups. But here is the catch: the user should only be able to to add user accounts to or delete user accounts from this group. The user should not be able add other groups to these groups.

Can someone help me out?

share|improve this question

I don't believe this is possible. The group object ACL permission allowing to add members will allow both users/ groups to be added. The only way I can think of to accomplish something like this would be to write a scheduled script that checks the managed groups members and removes any group objects if found.

share|improve this answer
Resolved: Don't know why I didn't think of this earlier.By using restricted Groups you can define which objects may be part of an AD Group. So I created a Restricted Group GPO hereby limiting membership for every security group and linked the GPO to the Domain Controller OU. This way whenever a group other than the one specified in the Restricted Group is added to a security group he will be automatically removed by Group Policy. Of course this is only workable in small environments with no more then 100 security groups. For larger environments a more efficient solution is in its place. – Clifton C. Lenne Mar 29 '11 at 1:05
Yes, this will prevent groups from being added to the groups you set up as restricted groups. However, it will also prevent any users from being added. This removes the ability of the AD user to administer the membership. – HostBits Mar 29 '11 at 13:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.