active directory -grant permission to undelete user only move and create

Question

active directory -grant permission to undelete user only move and create

jihad majed 520

I try to give user permission in an active directory to create users and move between them, but do not delete them. When I delegate control to some group, I do not have the option to undelete users.

Answer accepted by question author

1 additional answer

Your answer

Answer 1

Thameur-BOURBITA 36,506 Moderator

Hi @jihad majed

There is no undelete permission but you can select delete permission and choose deny.

In target OU , go to security Tab then click on advanced to be able to add or edit custom permission:

User's image

Please don't forget to accept helpful answer

jihad majed 520 Reputation points

2024-03-27T12:37:10.1533333+00:00

i checked the same but still can remove any user
Thameur-BOURBITA 36,506 Reputation points Moderator

2024-03-27T14:34:54.3533333+00:00

@jihad majed

Try to check if there is another delete permission already configured that can overwrite the deny.

Please don't forget to accept helpful answer
jihad majed 520 Reputation points

2024-03-28T08:21:11.1633333+00:00

If you see here, all the delete options are off, but where can I find them if I overwrite as you tell me?
Thameur-BOURBITA 36,506 Reputation points Moderator

2024-03-28T15:31:58.7366667+00:00

@jihad majed

Should be ok

Answer 2

Marcin Policht 77,665 MVP Volunteer Moderator

Use Delegation of Control Wizard. This can be VERY granular. More at https://learn.microsoft.com/en-us/answers/questions/973272/delegate-help-desk-users-permission-to-move-users

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Share via

active directory -grant permission to undelete user only move and create

1 additional answer

Your answer