Here is the thing: I've composed a template for Active Directory Users and Computers so our branches could add/delete/rename computers in their respective OUs on their own (without granting them Full Control over Computer objects).
So it's kinda restircted "Not So Full Contol". It works correctly, most of the time. But there are some computers which has subobjects in them. Like AD published printers or sometimes some other stuff like "RouterIdentity" container.
How can I grant permissions to local admins groups over their respective OUs so they could delete Computer objects along with any object within those computer objects?
Currently (in terms of delegwiz.inf file) I grant those groups permissions to create and delete computer objects but it is not enough to delete any subobject.
[TemplateXX.SCOPE] computer=CC,DC
0 Answers