Resolution
goal
Can I configure DRA so Assistant Admins can only create sub-OUs in child OUs, and not in the parent OU?
goal
How do I create an ActiveView so Assistant Admins can create sub-OUs under a child OU only?
fact
Directory and Resource Administrator 6.x
fact
Directory and Resource Administrator 7.x
fix
Can I configure DRA so Assistant Admins can only create sub-OUs in child OUs, and not in the parent OU?
goal
How do I create an ActiveView so Assistant Admins can create sub-OUs under a child OU only?
fact
Directory and Resource Administrator 6.x
fact
Directory and Resource Administrator 7.x
fix
If you have a parent OU with child OUs and you want to delegate the ability for Assistant Admins to create sub-OU containers only in the child OU, you can create an ActiveView that only allows Assistant Admins to create sub-OU containers in the child OU.
To delegate the ability to create sub-OUs only in a child OU in DRA 6.x:
- Log on to a computer where you have installed the DRA MMC console with an Assistant Admin account with the Built-in Security role.
- Open the DRA MMC console.
- Expand ActiveView management.
- Select ActiveViews, and then click New.
- Type in a name for the ActiveView, and then click Finish.
- On the Add objects window, in the Which objects do you want to include in this ActiveView area, select Include OU, and then click Next.
- On the Add objects window, in the From where to you want to select objects for this ActiveView area, select in specific domain.
- In the Rule Description area, select the domain, and then click OK.
- Click Next.
- On the Add objects window, in the What are the criteria for this object area, select Specific OU.
- In the Rule Description area, select the OU, and then click OK.
- Click Next.
- On the Add objects window, in the Which type of members are managed by this rule area, select the OUs check box, and then click Next.
- On the Add objects window, in the Add any restrictions area, deselect all options, and then click Next.
- Type a name for the rule, and then click Finish.
- In the What would you like to do next? window, click Assign Assistant Admins.
- Click Add Users.
- Select the user from the list, and then click Add.
- Click OK, and then click Next.
- Click Add Powers.
- Expand the Organizational Units node, and then expand the Create an OU node.
- Select the All Properties - Create an OU power, and then click Add.
- Click Next.
- Click Finish.
To delegate the ability to create sub-OUs only in a child OU in DRA 7.x:
- Log on to a computer where you have installed the Delegation and Configuration console with an Assistant Admin account with the Manage Security Model role.
- Open the Delegation and Configuration console.
- Expand Delegation Management.
- On the Tasks menu, select NewActiveView.
- Click Next.
- Click Add, and then select Objects that match a rule.
- Select Organizational Units.
- Click Any OU, and then select Specific OU.
- Select the desired OU.
- Click OK.
- Right-click the selected OU, and then click Manage Specific Object Types in OU.
- Ensure only the Organizational Units check box is selected. Clear all other check boxes.
- Click OK.
- Click OK.
- Click Next.
- Type a name and description for the ActiveView.
- Click Next.
- On the Summary window, ensure the I want to delegate po.
wer over this ActiveView after I finish this wizard check box is selected. - Click Finish.
- On the Welcome to the Delegation Wizard window, click Next.
- Click Add, and then select Users.
- Type the name of the desired user in the text box, and then click Find Now.
- Select the user, and then click Add.
- Click OK, and then click Next.
- On the specify Roles and Powers window, click Add, and then select Powers.
- In the text box, type Create OU, and then click Find Now.
- Select Create OU and Modify All Properties, and then click Add.
- Click OK.
- Click Finish.
Additional Information
Formerly known as NETIQKB28189