Windows Server - Creating and Editing GPOs

Group Policy Default Permissions

By default, the following user and groups have Full Control over GPO management:

• Domain Admins
• Enterprise Admins
• Group Policy Creator Owners
• Local System

The Authenticated Users group has Read and Apply Group Policy permissions.

Creating GPOs

By default, only Domain Admins, Enterprise Admins, and Group Policy Creator Owners can create new GPOs. You can use two methods to grant a group or user this right:

• Add the user or group to the Group Policy Creator Owners group.
• Explicitly grant the group or user permission to create GPOs by using the GPMC.

Editing GPOs

To edit a GPO, the user must have both Read and Write access to the GPO. You can grant this permission by using the GPMC.