Steve-
In
order to delegate creation of GPOs, you need to grant access to the
System\Policies container within the Domain, and within the Policies folder
under SYSVOL rather than granting a right at the domain level. The easiest
way to do this, without getting in and modifying ACLs directly on AD and
the file system, is to use the GPMC to delegate creation and
editing of GPO objects. The GPMC simplifies it quite a bit.
Good
luck,
Darren
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Byrne, Steve
Sent: Tuesday, October 07, 2003 9:22 PM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Child domain delegationHi All, I have recently created a "staging" child domain that duplicates our real domain with the goal of using it to create and test group policy objects.My Domain Admin users did not have any rights in the Child domain (only Ent Admins)I have tried to delegate authority at the domain level, to the parent domain\Domain Admins group, but the users still cannot create/edit Group Policy Objects...Any idea where I have gone wrong?Cheers, Steve B
