E.5 Non-Domain Admin AD Rights Needed for the Export Only Account:

Since these permissions are native to Microsoft AD, we recommend that you configure the permissions using Group Policy PowerShell scripts and Microsoft GPMC.

Task	Microsoft Native Option	Example
Create GPOs in the domain	Add the Export Only account to the global Group Policy Creator Owners group.	None
Modify GPO Link and GP Option	Grant Link GPOs permission using GPMC. For more information, see Microsoft Documentation.	None
Full Edit permission in the GPO (for existing GPOs in AD)	Execute PS Set-GPPermission as per Microsoft Documentation.	Import-Module GroupPolicy $params = @{ All = $true TargetName = "AccountName" TargetType = 'User' PermissionLevel = 'GpoEditDeleteModifySecurity' Replace = $true } Set-GPPermission @params NOTE:Replace "AccountName" with Export Only Account name.

Task

Microsoft Native Option

Example

Create GPOs in the domain

Add the Export Only account to the global Group Policy Creator Owners group.

None

Modify GPO Link and GP Option

Grant Link GPOs permission using GPMC. For more information, see Microsoft Documentation.

None

Full Edit permission in the GPO (for existing GPOs in AD)

Execute PS Set-GPPermission as per Microsoft Documentation.

Import-Module GroupPolicy

$params = @{ All = $true TargetName = "AccountName" TargetType = 'User' PermissionLevel = 'GpoEditDeleteModifySecurity' Replace = $true } Set-GPPermission @params

NOTE:Replace "AccountName" with Export Only Account name.