Delegate Access in Active Directory

This article will demonstrate how to delegate access in Active Directory. Rather than granting accounts broad access to accomplish simple and directed tasks, learn how to grant granular access for accounts to perform specific actions in Active Directory. In the event of an account breach, a user with broad access can cause much more damage than a user that only has access to complete a finite number of tasks.

A few use cases are below. Again, the goal is to grant specific access and not add accounts to highly privileged groups such as Domain Admins.

• Service accounts needed access to complete specific functions
• Help desk accounts need to reset passwords or update an attribute
• An account needed to update group membership

This article will use the delegation control wizard in Active Directory. OU and group structure is out of scope for this and the focus will be on delegating control specifically on users, but could be done on an OU or group.

Delegation of Control Wizard

1. In Active Directory Users and Computers, right click on the OU you are delegating access to and click Delegate Control. Note that this is the OU the user you are granting access to manage. Make it as specific as possible.
2. Click Next.
3. Select the user you want to delegate control to.
4. Click Next.
5. Choose between common tasks and a custom task. For this example we will choose a custom task.
6. Select Only the following objects in the folder and User objects.
7. Click Next.
8. Select Property-specific
9. Select the read and write permission to the specific access you are delegating control for.
10. Click Next.
11. Review the output and click Finish.

Conclusion – Delegate Access in Active Directory

That’s it. You’ve delegated access in Active Directory. Granular access isn’t that difficult to accomplish. This was a simple example so explore with a better OU and Security group structure. If you found this article helpful read more of our Active Directory content.