group policy

The previous installment of this article outlined how to grant a security group the right to log on locally as well as read/write permission to the Sysvol. In addition, you need appropriate administrative permission to the site, domain, or organizational unit (OU) in which the Group Policy Object (GPO) resides. To delegate administration:

Open Active [...]

Before you delegate administrative control over a Group Policy Object (GPO), you need to grant the appropriate group the right to log on locally as well as read/write access to the Sysvol.
In order to manage group policies, you must have access to a domain controller (DC) for the Active Directory (AD) in which the Group [...]

Group policies are so useful and flexible not just because of what they enable you to do, but also because of how they enable you to do it. GPOs allow you to delegate administrative control over group policies at any level that suits your enterprise’s needs. For example, you might delegate administrative control of an [...]

By allowing group policies in higher levels to overwrite policies in lower levels, Windows Server 2003 provides for inheritance of policies from higher layers. For example, assume you belong to the OU Helpdesk, which is a child OU of Support. Some policies would be applied directly by the GPOs associated with the Helpdesk OU, while [...]