Home / server / Questions / 514513
Accepted
PnP
Asked: 2013-06-10 12:52:46 +0800 CST

Permission to create GPOs

  • 772

Is the sole reason of the Group Policy Creator Owner group just to dish out permissions to other users to create (and then modify only their own) GPOs in the domain?

Is there another way to do this via Powershell, or is this group the only way? i.e. just dish out the permissions without being a member of the said group.

There is a PS cmdlet such like: Set-GPPermission for example etc. Although according to their technet on the article it doesn't really apply.

active-directory

1 Answers

  1. Best Answer

    From TechNet:

    The ability to create GPOs in a domain is a permission that is managed on a per-domain basis. By default, only Domain Administrators, Enterprise Administrators, Group Policy Creator Owners, and SYSTEM can create new Group Policy objects. If the domain administrator wants a non-administrator or non-administrative group to be able to create GPOs, that user or group can be added to the Group Policy Creator Owners security group. Alternatively, you can use the Delegation tab on the Group Policy Objects container in GPMC to delegate creation of GPOs.

    So yes, if you want someone to create GPOs, either put them in the GP Creator Owners group, or delegate the permission to create and link GPOs to another group of your choosing.

    Set-GPPermission does not really concern you. That Cmdlet is about targeting so you can prevent a GPO from applying to certain principals even though their location in the OU structure would otherwise fall under the scope of that GPO.

    • 6