I would like to delegate GPO creation to a handful of people. I open GPMC and then go to group policy objects. I select the delegation tab and try to remove the domain admins. I receive an error -- "The Request is not Supported"
Is my only option to go into the ACL on the domain using ADU&C and strip their rights that way. I realize that a lot of people on this board are going to ask why are these people domain admins? If you don't trust them to create a GPO then they probably shouldn't be a DA. I agree with those that share that sentiment but I have given up on that fight at this point. Sometimes the people the sign the checks win. Thanks Mike List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
