Permissions to move accounts

Question

I found several sites that detailed permissions required to move accounts in AD.

e.g. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc772637(v=ws.10)

I have granted those permissions but still get access denied.

This is what I have done:

A scheduled script is run using account 'scriptacct'.

This script moves group 'testgroup' from 'sourceOU' to 'DestOU'.

The permissions are set for acct 'scriptacct' as follows:

Create/delete groups on both sourceOU and DestOU (CC and DC).

Write property for CN and RDN on both sourceOU and DestOU (known as 'name' and 'Name' in ADAC).

That's the only permissions I thought I needed but dont seem to be enough?

Thanks

David Z

Answer 1

Got it. Turns out the above link was wrong.

Also, this wiki leak is wrong:

https://social.technet.microsoft.com/wiki/contents/articles/20747.delegate-moving-user-group-and-computer-accounts-between-organizational-units-in-active-directory.aspx

I noted the last comment and then added the 'delete' permission on descendant group objects and it worked!