Information Technology Reference
In-Depth Information
5.
Click OK; the user is added to the Delegation list.
You can delegate permissions to create GPOs in the domain by either adding the users to
the Group Policy Creator Owners security group, or adding the user or group to the Delega-
tion tab as described previously for individual GPOs.
You can delegate permissions to Link GPOs, to Perform Group Policy Modeling Analyses,
or to Read Group Policy Results Data to a site, domain, or OU by selecting the site, domain,
or OU in the console tree and then clicking the Delegation tab in the details pane. Select the
permission you want to delegate and then click Add to add the user or group. You can restrict
the delegation to the specific container or include child containers.
Thought experiment
Creating a comprehensive GPO management policy
In this thought experiment, apply what you've learned about this objective. You can
find answers to these questions in the “Answers” section at the end of this chapter.
You are the network administrator for TreyResearch.net. The Engineering group
works out of a separate campus with its own support staff who are not currently
members of the Domain Admins group. You need to create a comprehensive GPO
management policy that enable the Engineering support staff to manage Group
Policy for Engineering while also ensuring that you can quickly recover if they make
a change that has unanticipated consequences.
1.
What changes do you need to make to allow Engineering support staff to man-
age the Group Policy?
2.
How can you ensure that you can quickly recover if there are problems with a
GPO?
■
Back up GPOs to provide an easy recovery scenario.
■
Use Import Settings to copy the settings from a backed-up GPO to a new or existing
GPO.
■
Copy GPOs within the domain or across domain boundaries.
■
Use Migration Tables to copy or import GPOs from another domain.
■
Reset the Default Domain Policy or the Default Domain Controller Policy to return to
an as-installed condition for these critical GPOs.
■
Use the Delegation tab in GPMC to delegate authority to edit GPOs.
