Delegate Control of an Organizational Unit

Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012

Membership in Account Operators , Domain Admins , or Enterprise Admins , or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at https://go.microsoft.com/fwlink/?LinkId=83477.

To delegate control of an organizational unit

1. To open Active Directory Users and Computers, click Start , click Control Panel , double-click Administrative Tools , and then double-click Active Directory Users and Computers .

   To open Active Directory Users and Computers in Windows Server® 2012, click Start , type dsa.msc .

2. In the console tree, right-click the organizational unit (OU) for which you want to delegate control.

   Where?

   • Active Directory Users and Computers\ domain node \ organizational unit

3. Click Delegate Control to start the Delegation of Control Wizard, and then follow the instructions in the wizard.

Additional considerations

• To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

Additional references

• Managing Organizational Units