In the Group Policy Management Console I am attempting to delegate the "Link GPOs" right, but after selecting the group to delegate the access to and the "This container and all child containers" option, I am receiving the error message "The request is not supported".
Here's a screenshot of the same error on the Microsoft Forums. In that case, the user was attempting to remove a delegation.
What causes this error and how can the problem be resolved?
This error occurs when the user has existing permissions on the Active Directory OU that the Group Policy Management Console (GPMC) doesn't know how to deal with. It should be noted that group policy delegations are really just permissions on the OU, the GPMC just provides a simplified interface to make the necessary permissions changes easier.
You can use Active Directory Users and Computers to check the permissions on the OU. You will need to enable "Advanced Features" from the View menu in order to see the Security tab for an OU object, and you will need to choose "Advanced" to see the detailed permissions list.
In my case, the group in question had been explicitly granted "Read" access to the OU, which must have been added by mistake at some point since it is redundant. In the linked question on the Microsoft Forums, the user was attempting to change delegation for the Domain Admins group which by default has Full Control on all OUs.
In my case, since the existing Read permission didn't need to be there, I removed it using Active Directory Users and Computers. I was then able to use the GPMC to add the delegation I wanted.
The user in the linked Microsoft Forums question could have removed the Full Control permission for Domain Admins the same way, which would have also removed the group policy delegation as a side-effect. (Whether this is a sensible change is another matter!)
In other cases, if the extra permissions cannot be removed, you can grant the necessary delegation directly in Active Directory Users and Computers rather than via the Group Policy Management Console. If you want to grant the "Link GPOs" delegation then the necessary access permissions are "Read gPLink", "Write gPLink", "Read gPOptions", and "Write gPOptions". Once the change is made, refreshing the view in the Group Policy Management Console should show the newly created delegation.