Question

The Server Help Desk security group was delegated permission to create and delete user objects in an organizational unit called Apprentices. One of the users named Ryan is currently signed-in to a Windows 10 running RSAT. He is managing user objects in the Apprentices OU. The domain administrator modified the delegated permission granted to Server Help Desk security group to include create and delete group objects. Ryan opened Active Directory Users and Computers but couldn't find the command to create a New Group. He can see the command to create a New User. What must be done to resolve this issue?

A. Ask Ryan to sign out and sign back in to Windows 10 where RSAT is installed.

B. Add user named Ryan to Account Operators group in the domain.

C. Ask the domain administrator to re-run Delegate Control and explicitly add Ryan to have the permission to create and delete group objects.

D. Use the Run as administrator to launch Active Directory Users and Computer.

Answer 1

To resolve the issue where Ryan cannot see the command to create a new group, he should first refresh the console or log off and back in. If that does not work, he may need to use the 'Run as administrator' option to launch Active Directory Users and Computers. If problems persist, consulting the domain administrator to confirm permissions and checking for replication delays is advisable.

Step-by-step explanation:

The student is experiencing an issue where even after the domain administrator modified the delegated permissions for the Server Help Desk security group to include the ability to create and delete group objects, the user Ryan, who is signed in to a Windows 10 machine running Remote Server Administration Tools (RSAT), cannot see the command to create a new group in the Active Directory Users and Computers console. The most likely explanation for this issue is that the modification in permissions has not updated in Ryan's current session.

To resolve this issue, Ryan can take the following steps:

• First, Ryan should try to refresh the Active Directory Users and Computers console to see if the updated permissions appear, which sometimes can be effective.
• If the refresh does not work, Ryan should log off and then log back in to have the permission changes take effect in his new session. Changes to security group memberships or delegated permissions often require a new logon session because the user's access token, which is created at logon, needs to reflect the latest permissions.
• If the issue persists, using the Run as administrator option to relaunch Active Directory Users and Computers may be necessary. This action will grant Ryan's session, additional privileges that can help in cases where there are elevation requirements.
• If none of these steps resolve the issue, Ryan should contact the domain administrator to confirm the changes have been properly applied and to check for potential replication delays between domain controllers if the environment is large and distributed.