Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to provide taskpads to few admins to operate on few tasks delegated to them at OU level.I ran into the following problem;

lets say i delegated access to the admin on OU X and which is ability to modify groups such as sample group X1 , he must be able to add any users from OU X to the group X1.

The issue here is while testing i found out the admin can do the above but also can add a user Y1 from the OU Y(which he doesnt have delegated permissions) to the group X1.What am i missing? how to restrict admin from adding users out of OU to the groups he has modify access to?

Please ask me if any more details/clarification required.

share|improve this question
up vote 2 down vote accepted

You can't really do this. If you give a user the ability to add users to a group, they can add any user that their account can read. Since you need to fundamentally change how AD permissions are laid out to restrict limited user accounts from reading basic attributes of other users, it's typically an unsupported config that will break plenty of things that you didn't mean to break.

In short, there's no real functionality in place to say "you can add [user]to this group as long as [user] exists in this one OU" without a major modification to the default AD permission layout.

share|improve this answer
so a admin doesnt need any write properties on a user account to add it to a group? – Darktux Nov 14 '12 at 17:03
No. They don't. As long as they can view the object, they can add it to any group that they can add members to. – MDMarra Nov 14 '12 at 17:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.