Delegated permissions for removing MSMQ sub object in AD
Hi all,
i need to remove the msmq sub-object in AD from computer accounts on a recurring basis.
Specifically i am referring the the MSMQ container that gets created at CN=MSMQ,CN=ServerName,OU=OUName,DC=Company,DC=Com when enabling AD integration for MSMQ within windows.
As an admin, i (or any of the other admins) can do this - but given we want to script this ability using a service account - we are trying to lock down the permissions for this service account to that specific purpose.
Now,. before you say it, I have delegated control (and verified the delegated permissions) with the following settings
and (just incase it was somehow different)
and neither of these allow the service account to delete the MSMQ container.
i dont want to allocate full control to the service account over these OU's.... and am looking for assistance in what delegation allows the object to be removed.