I am in a large organization with multiple domains in a forest and lots of OUs in each domain. The domain admins delegate administration of the OUs to IT personnel that work in the OU. I am one of those IT people. I can create and delete sub-OUs in our OU, we've been assigned the ability to manage GPOs that apply to us. etc. We have geographically separated groups that we've created separate sub-OUs for and delegated the ability to manage those OUs to personnel there.
At one of those sites, we have a group with full control of the OU they are in, but we are not able to modify any groups they have created. For instance, if I wanted to add an account to a group in the OU, I do not have that ability, even though I have full control of the OU it is in. I realize the security group has a list of ACEs in the security tab and I'm not granted permissions there.
Is there a way I can force a group of my choice to be added to the ACE list on all security groups under our OU?