Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have on account and I don't want to give it Administrator permissions, only to create OU, users, and groups. The trouble is that Accounts Operator can't create OU, how can I add a group for this purpose? Or can I change the permissions of Accounts Operator group?

The domain is made with Windows Server 2003.

share|improve this question
up vote 4 down vote accepted

There are two ways you can really do this.

  1. As Above, go into the Active Directory Users And Computers console, create an OU just under your domain that envelops your entire domain, then use the Delegate Control Wizard to provide the permissions to the users or groups as needed. That tool can be found by right clicking the OU in question. For organization reasons generally it is best to create a group and nest all the users in that group that need to administer the OU and groups. This means that you can add and remove users with those permissions quickly without having to further change your base distribution.

  2. Go into the 'View' Menu in Active Directory Users and Computers and enable the 'Advanced Features' option. You can then right-click on your base domain OU or your secondary OU that you create as I suggested above and go into the properties. With the Advanced View on each OU will have it's own security tab now. From there you can go to each security group and granularly alter the permissions on those OUs based on groups or users. If you go into the advanced view in security you can break each permission down into each component and alter them as specifically or as openly as you'd like.

share|improve this answer

You should always try to delegate tasks in Active Directory based on least-privilege.

For the tasks you wish to delegate, you only need to grant Create Child - User Objects, Create Child - Group Objects and Create-Child Organizational Unit permissions.

To do so, you'll be best off creating an OU immediately under your domain object, creating a group to which to delegate access to, and then grant the above three permissions on the OU using the steps outlined above by Laranostz.

After you have delegated these tasks, you should also make sure that you verify your delegations. For more info how to verify delegations -

There is also a tool that can help verify delegations called "Gold Finger for AD". It was designed by a former Microsoft Security Expert and I believe it is also endorsed by Microsoft.

Disclaimer: I am not affiliated with the vendor of the above mentioned tool. I have used the tool and think highly of it, so I am mentioning it, because it is important to verify delegations.

share|improve this answer

Have a look at the delegation feature of active directory. I would create an OU in your domain and then delegate at that OU level instead of at the domain level. This will keep your user locked to only creating OUs within this OU. I believe you will have to go in to the advanced permissions part of the delegation wizard.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.