Delegating server administration

As networks grow, so does the number of administrative tasks there are to perform on a regular basis, and so does the IT staff that is needed to perform them. Delegating administrative tasks to specific individuals is a natural part of enterprise server management, as is assigning those individuals the permissions they need—and only the permissions they need—to perform those tasks.
On smaller networks with small IT staffs, it is not uncommon for task delegation to be informal and for everyone in the IT department to have full access to the entire network.
However, on larger networks with larger IT staffs, this becomes increasingly impractical. For example, you might want the newly hired junior IT staffers to be able to create new user accounts but not be able to redesign your Active Directory tree or change the CEO’s password.
Delegation is the practice by which administrators grant other users a subset of the privileges that they possess. As such, delegation is as much a matter of restricting permissions as it is of granting them. You want to provide individuals with the privileges they need while protecting sensitive information and delicate infrastructure.