I am trying to delegate permission for users to create an OU in active directory, strictly as an option to organize and sort objects under the delegated OU. However, once I give the permission, the user can change the security rules on the new OU he created and gain full control permissions, subsequently allowing himself to create new user accounts and etc.

Is there a way to prevent such a security breach?

  • What exactly did you delegate? Is "Creator owner" Allow:Full Control in the ACL? – Semicolon Mar 16 '20 at 19:22
  • I used the delegate control wizard. after selecting the group, I choose to create a custom task, the following screen I choose 'only the following object' and check only the OU object, with both create and delete permissions, and on the last screen (permissions) I allow 'read properties' – GKman Mar 17 '20 at 11:46

It sounds like you over-delegated access. You need to grant the Allow: "Create Organizational Units" permission, scoped to "Descendant Organizational Units" in order to achieve this. Some screenshots below:

The scope (or "applies to") that needs to be selected: Scope Selection

The permission that needs to be selected: Permissions Entry

This is what the ACE will look like when completed: Final Access Control Entry

-- This will not allow the delegate to actually change/rename any OUs (in the event of a typo). This will strictly allow the delegate to create Organizational Units.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.