Delegate Right to delete gpos (new created policies and existing policies)

Question

Hi
I want to create a delegation for all group policies in the domain for Active Directory Group over GPMC.
The users in this group should have rights to delete existing group policies .
I know that I can delegate this per gpo (Select GPO > Delegation Tab > AD Group). But I want to delegate this right on the whole Domain. For existing gpos, I could use a powershell script which adds the delegation group on all existing policies. But
I can't find a way to delegate this right for new created GPOs.
Is there a way to this?
Thanks for your support!
Miro

Answer 1

Am 24.10.2014 um 09:24 schrieb m.hegnauer:
> Now the delegation is set on both (domain level and "Group Policy
> Objects"), but "Access denied" appears again. On the "Group Policy
> Objects"  Delegations Tab, I only can Add or Remove a user / group, but
> I can't adjust the rights.
I seem to remember that granting through the UI will
a) not take effect on existing GPOs and
b) not take effect on GPOs created by others.
You need to modify the "policies" container ACL and the WMI filters
container ACL in Active Directory.
A colleague of mine implemented this some time ago. This is what we set:
     <grant objectdn="CN=SOM,CN=WMIPolicy,CN=System,DC=yourdomain"
nc="DefaultNC" type="Container" trustee="GPO-Admins"
                    description="Full Control"
inheritance="ADS_ACEFLAG_INHERIT_ACE" rights="FULL_CONTROL" />
    <grant objectdn="CN=Policies,CN=System,DC=yourdomain"
nc="DefaultNC" type="Action"    trustee="GPO-Admins"
objectguid="ATTRIBUTE_GUID_GPOGUID"    description="Create/Delete GPOs"
inheritance="ADS_ACEFLAG_INHERIT_ACE"
rights="DS_CREATE_CHILD;DS_DELETE_CHILD"/>
    <grant objectdn="DC=yourdomain"                 nc="DefaultNC"
type="Action"    trustee="GPO-Admins"
objectguid="ATTRIBUTE_GUID_GP_LINK"    description="Link GPOs"
inheritance="ADS_ACEFLAG_INHERIT_ACE" rights="DS_READ_PROP;DS_WRITE_PROP"/>
    <grant objectdn="DC=yourdomain"                 nc="DefaultNC"
type="Action"    trustee="GPO-Admins"
objectguid="ATTRIBUTE_GUID_GP_OPTIONS" description="Change GP Options"
inheritance="ADS_ACEFLAG_INHERIT_ACE" rights="DS_READ_PROP;DS_WRITE_PROP"/>
I checked his script, but it is way too complicated to post it here or
anywhere else =:o
In addition, you have to grant GPO-Admins sufficient access to
sysvol\policies:
"icacls.exe" & SysvolRoot & "\Policies /grant
GPO-Admins:(OI)(CI)(X,RD,RA,REA,WD,AD,WA,WEA,DC,RC)"
Both is done through VBS, so you need some Constants and GUIDs :)
'ACL Constants
Const   ADS_ACETYPE_ACCESS_ALLOWED           = 0
Const   ADS_ACETYPE_ACCESS_DENIED            = &H1
Const   ADS_ACETYPE_SYSTEM_AUDIT             = &H2
Const   ADS_ACETYPE_ACCESS_ALLOWED_OBJECT    = &H5
Const   ADS_ACETYPE_ACCESS_DENIED_OBJECT     = &H6
Const   ADS_ACETYPE_SYSTEM_AUDIT_OBJECT      = &H7
Const   ADS_RIGHT_DELETE                     = &H10000
Const   ADS_RIGHT_READ_CONTROL               = &H20000
Const   ADS_RIGHT_WRITE_DAC                  = &H40000
Const   ADS_RIGHT_WRITE_OWNER                = &H80000
Const   ADS_RIGHT_SYNCHRONIZE                = &H100000
Const   ADS_RIGHT_ACCESS_SYSTEM_SECURITY     = &H1000000
Const   ADS_RIGHT_GENERIC_READ               = &H80000000
Const   ADS_RIGHT_GENERIC_WRITE              = &H40000000
Const   ADS_RIGHT_GENERIC_EXECUTE            = &H20000000
Const   ADS_RIGHT_GENERIC_ALL                = &H10000000
Const   ADS_RIGHT_DS_CREATE_CHILD            = &H1
Const   ADS_RIGHT_DS_DELETE_CHILD            = &H2
Const   ADS_RIGHT_ACTRL_DS_LIST              = &H4
Const   ADS_RIGHT_DS_SELF                    = &H8
Const   ADS_RIGHT_DS_READ_PROP               = &H10
Const   ADS_RIGHT_DS_WRITE_PROP              = &H20
Const   ADS_RIGHT_DS_DELETE_TREE             = &H40
Const   ADS_RIGHT_DS_LIST_OBJECT             = &H80
Const   ADS_RIGHT_DS_CONTROL_ACCESS          = &H100
Const   ADS_RIGHT_FULL_CONTROL               = 983551
Const   ADS_ACEFLAG_INHERIT_ACE              = &H2
Const   ADS_ACEFLAG_NO_PROPAGATE_INHERIT_ACE = &H4
Const   ADS_ACEFLAG_INHERIT_ONLY_ACE         = &H8
Const   ADS_ACEFLAG_INHERITED_ACE            = &H10
Const   ADS_ACEFLAG_VALID_INHERIT_FLAGS      = &H1f
Const   ADS_ACEFLAG_SUCCESSFUL_ACCESS        = &H40
Const   ADS_ACEFLAG_FAILED_ACCESS            = &H80
'Object GUIDs
Const OBJECT_GUID_COMPUTERS         =
"{bf967a86-0de6-11d0-a285-00aa003049e2}"
Const OBJECT_GUID_USERS             =
"{bf967aba-0de6-11d0-a285-00aa003049e2}"
Const OBJECT_GUID_GROUPS            =
"{bf967a9c-0de6-11d0-a285-00aa003049e2}"
Const OBJECT_GUID_PRINTERS          =
"{bf967aa8-0de6-11d0-a285-00aa003049e2}"
Const Object_GUID_OU                 = "{bf967aa5-0de6-11d0-a285-00aa003049e2}"
Const Object_GUID_CONTACTS          =
"{5CB41ED0-0E4C-11D0-A286-00AA003049E2}"
Const Obejct_GUID_FtDfs                =
"{8447f9f3-1027-11d0-a05f-00aa006c33ed}"
Const Object_GUID_NTFRS_Replica_Set =
"{5245803a-ca6a-11d0-afff-0000f80367c1}"
Const Object_GUID_NTFRS_settings    =
"{f780acc2-56f0-11d1-a9c6-0000f80367c1}"
Const Object_GUID_NTFRS_Member      =
"{2a132586-9373-11d1-aebc-0000f80367c1}"
Const Object_GUID_NTDSConnection    =
"{19195a60-6da0-11d0-afd3-00c04fd930c9}"
Const Object_GUID_Server            =
"{bf967a92-0de6-11d0-a285-00aa003049e2}"
Const Object_GUID_Subnet            =
"{b7b13124-b82e-11d0-afee-0000f80367c1}"
Const Object_GUID_Site              =
"{bf967ab3-0de6-11d0-a285-00aa003049e2}"
Const Object_GUID_Sitelink          =
"{d50c2cde-8951-11d1-aebc-0000f80367c1}"
Const Object_GUID_ServersContainer  =
"{f780acc0-56f0-11d1-a9c6-0000f80367c1}"
Const Object_GUID_msWMIRule         =
"{3c7e6f83-dd0e-481b-a0c2-74cd96ef2a66}"
Const Object_GUID_msWMISom          =
"{ab857078-0142-4406-945b-34c9b6b13372}"
'Attribute GUIDs
Const ATTRIBUTE_GUID_LOCKOUT_TIME   =
"{28630EBF-41D5-11D1-A9C1-0000F80367C1}"
Const ATTRIBUTE_GUID_PWD            =
"{00299570-246d-11d0-a768-00aa006e0529}"
Const GPOLinkProp                   =
"{f30e3bbe-9ff0-11d1-b603-0000f80367c1}"
Const GPOOptProp                    =
"{f30e3bbf-9ff0-11d1-b603-0000f80367c1}"
Const GPOGUID                       =
"{f30e3bc2-9ff0-11d1-b603-0000f80367c1}"
Const Generate_RSoP_Planning        =
"{b7b1b3dd-ab09-4242-9e30-9980e5d322f7}"
Const Generate_RSoP_Logging         =
"{b7b1b3de-ab09-4242-9e30-9980e5d322f7}"
Const USER_ACCOUNT_RESTRICTIONS     =
"{4C164200-20C0-11D0-A768-00AA006E0529}"
Const ATTRIBUTE_GUID_MEMBERS        =
"{bf9679c0-0de6-11d0-a285-00aa003049e2)"
Const Change_Schema_Master          =
"{E12B56B6-0A95-11D1-ADBB-00C04FD8D5CD}"
Const MemberProp                    =
"{BF9679C0-0DE6-11D0-A285-00AA003049E2}"
Const Given_Name                    =
"{F0F8FF8E-1191-11D0-A060-00AA006C33ED}"
Const Surname                       =
"{BF967A41-0DE6-11D0-A285-00AA003049E2}"
Const Telephone_Number              =
"{BF967A49-0DE6-11D0-A285-00AA003049E2}"
Const Phone_Mobile_Primary          =
"{F0F8FFA3-1191-11D0-A060-00AA006C33ED}"
Const Facsimile_Telephone_Number    =
"{BF967974-0DE6-11D0-A285-00AA003049E2}"
Const E_mail_Addresses              =
"{BF967961-0DE6-11D0-A285-00AA003049E2}"
Const SAM_Account_Name              =
"{3E0ABFD0-126A-11D0-A060-00AA006C33ED}"
Const User_Principal_Name           =
"{28630EBB-41D5-11D1-A9C1-0000F80367C1}"
Const Street_Address                =
"{BF967A3A-0DE6-11D0-A285-00AA003049E2}"
Const ATTRIBUTE_GroupMember         =
"{Bf9679C0-0DE6-11D0-A285-00AA003049E2}"
Const NTFRS_SubscriptionsProp       =
"{2A132587-9373-11D1-AEBC-0000F80367C1}"
Const description                   =
"{bf967950-0de6-11d0-a285-00aa003049e2}"
Const postalCode                    =
"{bf9679fd-0de6-11d0-a285-00aa003049e2}"
Const DS_Replication_Get_Changes    =
"{1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}"
Const DS_Replication_Get_Changes_all=
"{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}"
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))