ok so here is my question... i'm setting up the active directory infrastructure for the insurance company i work for. i've set up groups and ou's as well as numerous policies. my question is how do i delegate SPECIFIC controls to local admins without having to install administrative tools on each admin comp. i want each department head (IT, HR, Marketing...) to have resource access to their own groups, users, and any pertinent policies. i.e HR admins would have the ability to add users...now what im looking for is a GUI that is completely integrated with active directory, user friendly for my non-technical local admins, and cost effective. does microsoft provide a program already? thanks a bunch.