OU delegates question

Sie

How can you check who has delegated control to an OU in AD?
(I know how to delegate control i just dont know how to check who is delegated! )

Cheers in advance.

eurotrash

I don't know either, but you can check the permissions and see who has what (special permissions) as this is what the delegation affects. Also you can check the effective permissions tab for a user/group to see what it has been delegated.
Rudimentary, I know, and there must be a better way.

blargoe

I always use the effective permissions thingy.

Sie

What i want to do is to find from an OU's who has access as apposed to know what groups have access to what OU's.

Im trying to find the groups that are delegated to a specific OU and dont want to have to go through each group to check!!

Something similar to the 'members' tab in a group secuirty setting rather than the 'member of' tab. (Hmmm.... making little sense i am. )

Danman32

You probably would need a third party product that will do the backtracking for you. As it stands now, we are lucky we now have the 'effective permissions' tab as it is. Unfortunately you have to give the security principle you want to verify against the resource. You can't ask what security principles have indirect access to a specific resource through groups, though you can now get direct principle access through inheritance.

Of course you could try extracting info using the command line utilities and write a script to process them.
Get the groups that have permissions, then have the script expand out the group memberships recursively down to the user.