Which group can add OU's in active directory? 1

[senseforgreed]

I want to permit a group off users in the domain to add organizational units (OU's) in active directory. This group of users do not have administrative privileges and I want to keep it that way. Does anyone know which group in a Windows 2000 domain can add OU's in AD, besides Administrator or a group that isn't a member off Administrators?
I don't know if it's possible but any help is appreciated...

 

[markhoward]

I believe that you would create a group (unless one already exists for your users) and then give that group permissions to create child objects under whatever level of container you choose (i.e. domain, system OU, Ou that you've created etc...)

Or you can use the Delegation Wizard, assignt the users/groups you want to be able to create OUs, create a custom task to delegate, and allow them to only create OUs in that container.

Hope that helps

 

[markhoward]

Actually probably best to use the delegation wizard so that you don't get overkill on the permissions you assign.

 

[senseforgreed]

I 've justed run the delegation wizard and tested it by logging in with a user from that particular group and it worked.

Thanks markhoward!!!