3 Easy Ways To Grant the rights to modify AD group membership and be Successful

Problem:

You would like to grant a non domain admin user the rights or permissions ,e.g your servicedesk staff, the ability to modify the group membership but only of certain groups.
There are two very easy ways of doing this and a third more granular approach if required.

Pre-requisites:

Ensure you have created an AD group and assign your users you want to grant access to this group. If possible, create a separate OU to house all the groups you intend to give rights to.

Option 1 - Delegation of Control

1. Right click the OU where the groups are and click Delegate Control… then click Next
2. Select your AD Group
   
   
3. Select Modify the membership of a group and click next
   
   
   
4. Click Next and Finish

Option 2 – Managed By

Note: you can use this on an OU or individual group.

1. Right the same OU then click Properties
2. Click the Managed By tab then click the Change… button
   
   
   
3. Specify your group and click OK

Option 3 – Using the security tab

If you need to be more granular,do it this way as it allows you to see exactly what permissions are associated with a given task and you can add additional permissions.

1. Right click either the OU or specific group you would like to grant access or modify right to
2. Click Properties
3. Click the Security Tab
4. Click Advanced
5. Click Add
6. Select your Group
7. On the Object tab Select Descendant Group Objects and enable:
   • Read Members
   • Write Members
     
     
     
     
8. Click OK until all windows are closed

That's it

Hope this has been informative. If you have any comments or questions do so below.