Advanced Group Policy Management - On privileges and roles

Question

Hello!
We are rolling out AGPM 4.0 SP2.  Seems to work well enough.
We currently have more than one set of standard permissions.  For example, our Citrix team controls GPOs for Citrix, our Desktop team controls GPOs for desktops, etc.
Is there no way to delineate this in AGPM?
My first thought was that I could use PowerShell to rapidly set, and regularly audit and auto-correct these privileges.  True to Group Policy form, there is limited PowerShell support - in this case, none at all.
My second thought was that templates might include AGPM roles.  So I could say 'Group X has privileges to Template A,' 'Group Y and Z have privileges to Template B,' and so forth.  When I create a template, it would include those permissions.
 Nope.
I'm all for opening up access, but this might be a tough sell.  Am I the only one who has disparate security boundaries around group policies?  Am I overlooking a solution to this?
Thanks!
RCM

Answer 1

Have you thought about multiple AGPM Servers, one for each group? Each AGPM store could utilize separate standard permissions and control the subset of policies which are within the scope of the
group. You can even
use Group Policy itself to manage a multiple AGPM Server environment.
Brandon
MDOP on the Springboard Series on TechNet