How to Delegate AD Rights to Users

How to Delegate AD Rights to Users

Delegating Administrative Privileges to Users in Active Directory

AD delegation lets administrators grant users or groups certain permissions without having to add them to privileged groups like Domain Admins and Account Operators. You can delegate control of your Active Directory environment by using the Active Directory Users and Computers (ADUC) snap-in. As a best practice, it is wise to delegate control to groups and not individual users.
 
Follow these steps to create a group of users and delegate certain controls to them without adding them to privileged groups. 
  1. Open Active Directory Users and Computers, right click on any Organizational Unit on which you have to delegate control.
  2. Click on New and then click on Group to create a new group.
  3. On New Object-Group console window, enter the details of the required group and configure the group scope to be Global, and the Group type to be Security. Click on OK. This will create the desired group.
  4. Right click on the group and click on Properties. Under the Members tab, click on Add to add users into this group.
  5. Now, right click on the Organizational Unit and click on Delegate Control to delegate permissions to the group of users.
  6. On the Delegation of Control Wizard, click on Next to continue.
  7. In Users and Groups console, click on Add to add the required group and click on Next to continue.
  8. In the Tasks to Delegate console, select Delegate the Following Common Tasks and select permissions from the given tasks. Click on Next to continue.
  9. On the Completing the Delegation of Control Wizard verify the selected options on previous consoles and click on Finish to close the console.
The users in the group can now carry out the specified common tasks. Thanks to AD Delegation, this can be done without adding those users to any privileged groups.