Delegate Control Wizard Cannot Be Used to Remove Groups or Users

• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows 2000 Server

SUMMARY

In Windows 2000, users or groups can be granted administrative privileges over containers and the objects within those containers. Although this can be performed by modifying the permissions on the container, Windows 2000 includes the Delegate Control Wizard to automate the task. Note, however, that although the Delegate Control Wizard can be used to grant users and groups administrative privileges over containers and the objects within them, it cannot be used to remove those privileges. Removal must be accomplished manually.

MORE INFORMATION

To delegate control on a container:

1. Start the Active Directory Users and Computers snap-in.



2. Right-click a domain or organizational unit, and then click Delegate Control.



3. Finish the wizard by selecting the users or groups and granting the appropriate permissions. The following permissions are predefined and can be granted singly or in any combination:
   
   
   • Create, delete, and manage user accounts
   
   
   
   • Reset password on a user account
   
   
   
   • Read all user information
   
   
   
   • Modify the membership of a group
   
   
   
   • Manage published printer queues
   
   
   
   Or, custom permissions can be used to delegate more specific control.

1. Start the Active Directory Users and Computers snap-in.



2. On the View menu, click Advanced. This enables the Security tab.



3. Right-click the container from which the permissions will be removed, and then click Properties.



4. Click the Security tab.



5. Remove the appropriate users or groups.

Additional query words:

Keywords : kbenv
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbinfo