group policy links, generating Resultant Set of Policy, and managing and viewing InOrgPerson accounts. A use of Delegation of Control could be to give managers complete control of users in their own department. With this arrangement managers can create new users, groups, and computer objects, but only in their own OU. See also Access control Identity management Provisioning RBAC Reading list Delegating Authority in Active Directory, TechNet Magazine Built-in Groups vs. Delegation, WindowsSecurity.Com Operating system technology Computer access control Decentralization Active Directory