Delegate access for Bitlocker recovery on an OU only?

Question

Can someone give me the steps to delegate access to an AD group for Bitlocker recovery passwords on an OU only? 
I have read the articles that have the vb script and talk about using ldp.exe,
http://technet.microsoft.com/en-us/library/cc771778(v=ws.10).aspx#BKMK_TestingRecovery
http://blogs.technet.com/b/craigf/archive/2011/01/26/delegating-access-in-ad-to-bitlocker-recovery-information.aspx
but I don't know how to do this specifically on an OU, and I need the steps to connect, bind, etc with ldp.exe as I never use this tool.
I tried the following but it doesn't work (bummer, because it's nice and simple)
http://blog.nextxpert.com/2011/01/11/how-to-delegate-access-to-bitlocker-recovery-information-in-active-directory/
Please give me instructions step-by-step to give a group bitlocker recovery password info on the tab in ADUC for a specific OU only (AD 2008 R2) - thanks!

Answer 1

Hi Sara,
I searched for delegating Bitlocker permission and found the same article as you provided.
In the first article you mentioned, it provided steps to delegate permission to a user group:
Appendix A: Delegating Permission
http://technet.microsoft.com/en-us/library/cc771778(WS.10).aspx#BKMK_AppendixA
The steps are:
1. Create a new user group.
2. Add members to the group (for example, add Helpdesk staff members).
3. Assign control access and read property permissions to the group.
And in your second article, the author replied about applying delegation to an OU in commons: 
There are only 2 reasons to create an OU:
1) Apply different GPOs
2) Apply different delegation.
And all we're doing here is delegating. So in LDP, instead of opening the ACL of the domain (as we're doing in the example above), you'd open the ACL on the relevant OUs and add different groups per OU. And the "control access flag" isn't a special function
of the domain object, you can apply it to OUs also.
Delegating access in AD to BitLocker recovery information
http://blogs.technet.com/b/craigf/archive/2011/01/26/delegating-access-in-ad-to-bitlocker-recovery-information.aspx
If you have any feedback on our support, please send to [email protected]