---
description: Idea of Delegation of Control ?
---

# Delegation of Control

## Delegation of Control in Active Directory

> 1. <mark style="background-color:blue;">Delegation of Control in AD is a feature that allows administrators to assign specific permissions to users or groups, enabling them to perform particular administrative tasks without granting them full administrative rights.</mark>
> 2. <mark style="background-color:blue;">Delegation of Control is typically managed through the Active Directory Users and Computers (ADUC) console using the Delegation of Control Wizard. This wizard provides a user-friendly interface for administrators to select users or groups and specify the tasks they can perform on specific objects or containers within AD</mark>

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

> <mark style="background-color:blue;">Before you can delegate control, you'll need the following prerequisites.</mark>

* You must be a member of the Domain Admins group or have been delegated the necessary permissions to perform the tasks you want to delegate.
* On the computer where you'll delegate control, you must have the AD DS Remote Server Administration Tools (RSAT) installed.
* _<mark style="color:blue;">**RSAT**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">stands for</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**Remote Server Administration Tools**</mark><mark style="color:blue;">.</mark>_\
  _<mark style="color:blue;">It’s a package of tools developed by</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**Microsoft**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">that allows</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**system administrators to manage Windows Server roles and features remotely**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">That directly from a regular Windows client machine (like Windows 10/11).</mark>_

## **Basic Concepts and Implementation**

> <mark style="background-color:blue;">Delegation of Control is typically managed through the Active Directory Users and Computers (ADUC) console using the Delegation of Control Wizard. This wizard provides a user-friendly interface for administrators to select users or groups and specify the tasks they can perform on specific objects or containers within AD.</mark>

## **Steps to Delegate Control Using the Wizard:**

1. <mark style="color:blue;">**Open ADUC**</mark>: Launch the Active Directory Users and Computers console, accessible from Administrative Tools or by running _<mark style="color:blue;">`dsa.msc`</mark>_.
2. <mark style="color:blue;">**Select the Container**</mark>: Right-click on the domain, OU, or container (an OU named "Sales") where you want to delegate control.
3. <mark style="color:blue;">**Start the Wizard**</mark>: Choose "Delegate Control" from the context menu to launch the wizard, which guides you through the process of the Tool.
4. <mark style="color:blue;">**Select Users or Groups**</mark>: Add the users or groups to whom you want to delegate permissions. For example, add a group named "HelpDesk\_PasswordReset".
5. <mark style="color:blue;">**Choose Tasks**</mark>: Select from predefined tasks ("Reset user passwords and force password change at next logon", "Create, delete, and manage user accounts") or create custom tasks with specific permissions.
6. <mark style="color:blue;">**Complete the Wizard**</mark>: Review the summary of delegated permissions and click Finish to apply the changes.

***

References :

{% embed url="https://activedirectorypro.com/delegate-control-in-active-directory/" %}

{% embed url="https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/delegation-control-wizard" %}

{% embed url="https://woshub.com/delegate-control-active-directory/" %}

***
