Delegate Control Wizard reports

Question

Does the Delegate Control Wizard in AD allow an auditor to view which permissions have already been 'delegated' within AD/a domain? Or is it purely for delegating new permissions? If it does not, how exactly could you determine where such permissions have been deleted and to whom within AD objects in the domain?

Purely out of interest, what sort of 'day to day' permissions & tasks is it common to delegate in AD?

Answer 1

In short, no.

For tracking permission changes, you'd need to implement auditing. Details at

https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/use-audit-active-directory-objects-track-events

For the best practices regarding delegation, refer to https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin