Question : Delegwiz deny mod?

I'm customizing the Delegwiz.inf file and am not finding any way to deny permissions. For example, to deny the deletion of a top level Organizational Unit to a specific group.

None of my docs explained how to do this. Does it exist? Below is an example of how to allow certain rights

[template14]
AppliesToClasses=domainDNS,organizationalUnit
Description = "Create an Organizational Unit"
ObjectTypes = SCOPE
[template14.SCOPE]
organizationalUnit=CC

Answer : Delegwiz deny mod?

The delegation wizard is used for delegating allowed permissions.
To deny permission, use the Security tab in the properties of the OU.
To see the Security-tab in the properties dialog, you nead to enable the View|'Advanced Features' option in ADUC