You need to give User1 administrative rights so that he can manage Group Policies for the Security OU