I have to grant some permissions to a certain user in Windows Server 2003 Active Directory that will only be active on a certain collection of users. The initial thought was to just have an OU that we would allow this particular user certain rights to (user creation, password reset, add users to groups, etc.). However, after reading further in to things, I'm not sure if an OU is needed or not, and I'm really not sure when an OU would ever be needed. This is bugging me and I would really like to better understand the purpose of OU's before using or not-using them.
I've searched the web quite a bit and results vary from the vague "Use organizational units to organize AD" to the somewhat specific "Add an OU to a domain if a completely separate group needs special administrative access to a segment of users." At this point, the later sounds the most appropriate here. Technically speaking, you can only use the Delegation of Control Wizard on an OU. However, I see nothing stopping me from manually assigning the permissions individually to a domain group and effectively having the same thing. What am I missing here? Thanks.