Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a group of users, lets call them DOMAIN\MyPowerUsers; I would like to give everyone in this group the abbility to create, edit, and delete users in the DOMAIN, and to modifiy group membership of users in the domain. Is this possible?

share|improve this question
up vote 2 down vote accepted

You need to Delegate Control to that group. In AD Users and Computers:

  • Right click on your domain DOMAIN.LOC

  • select Delegate Control

  • Next

  • Click Add and select the group

  • Select the permissions you wish to give the users (in your case, Create, Delete, Manage User Accounts & Modify the Memberships of Groups)

  • Click Next

  • Click Finish

share|improve this answer
Will this remove control the abbility of existing Domain Admins? – Nate Oct 8 '09 at 19:34
I ask because Delegate Control feels like I'm giving up the control to this group, is that the case? – Nate Oct 8 '09 at 20:12
@fuzzzerd: You're just adding an additional access control entry to the access control list when you do this. All the existing rights / permissions still apply. – Evan Anderson Oct 8 '09 at 21:20
Indeed. Evan speaketh the truth. – Izzy Oct 8 '09 at 21:48

You can do this by delegating control. If you open ADUC and then right click on the level of your tree that you want to delegate control to them (Domain root, OU, etc) there will be an option to delegate control. Walk through the wizard and it will ask who you want to delegate control to, then what you want them to be able to do Under Common tasks radio button there is an option to "Create, Delete and Manage Users" as well as "Modify the membership of a group" This will get you where you want to be.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.