In this demonstration,
I'm going to start by showing you some of the built‑in Active
Directory groups stuff that we talked about earlier.
We'll look at the delegation of Control wizard,
CredSSP Delegation, and Microsoft Defender for Identity.
You're looking at a Windows 10 domain joined workstation I have here,
and let me start by opening up Computer Management,
and just to illustrate what I was talking about is that
once you've domain joined a machine,
and we can verify that join by opening the System Control Panel,
I like to do the file name sysdm.cpl to open the Control Panel item directly.
So we can see the fully qualified domain name for
this machine is client1.timw.info.
So the local built‑in administrators group here,
as you can see,
contains the timw domain admins global group that happened automagically.
Now, do I have Active Directory users and computers on this machine?
I typed dsa.msc.
As it turns out, I do.
As a reminder or if you don't know this,
this is new, nowadays with Windows 10, as well as Windows 11,
you can install the Remote Server Administration Tools by
opening up the Optional features here.
And I don't think we can,
can we get to it from the settings or do we have to go
to the old school Control Panel?
I think we can stay in settings, yes.
So we go to Add a feature and you can type rsat and that will filter the
list for all of the Remote Server Administration Tools.
Now I've already installed them as you can see here.
In particular,
I installed the Active Directory tools which gives the
Active directory administration center,
the Active Directory Users and Computers console as you see here.
Okay, not a separate download anymore, although technically,
the Settings app does download them.
It just automates it for you.
So here we have in Users and Computers.
Again, we've got those built‑in groups like I've mentioned before,
specifically in the built‑in container,
these are our Active Directory domain local built‑in security groups.
There is administrators, and if we look at the membership of it,
we've got domain admins and enterprise admins in there by default.
If we go to the Users container,
we have our Enterprise Admin universal group that has only the
root forest root domain administrator account.
In it, notice that I've changed the default name.
I hope that you've already done the same,
that you've renamed the default administrator account.
You can do that across your entire domain by using Group Policy.
Now, in terms of delegated administration,
you've seen thus far about the read‑only domain controller.
Here, I have an RODC1.
Let's assume that this staff organizational unit contains the accounts used,
both computer and user and group accounts,
that are going to be in that remote office.
And so how could we give this Pat user, for example,
the ability to do password resets at the OU level.
Well, that's delegated control,
so let's right‑click Staff and start the Delegate Control Wizard.
Again, this is nothing new in Windows Server 2022.
Selected users and groups.
Well, I have this user named, I already forgot the user's name,
Pat, so let me try that again.
Delegate Control, Next, let's do Add, and look for Pat.
So Pat Colleague is going to be the designated password resetter,
and Microsoft has created a number of common tasks here,
or you can go right down to the schema and determine
individual tasks that you want to delegate.
For something like passwords,
it's easily enough accomplished just by selecting reset user
passwords and force password change at next logon. Delegated administration, nice feature of Active Directory.