Share via

AD Delegation not applying

Scott Giesbrecht 1 Reputation point
2020-07-28T22:07:36.397+00:00

I have 2 sub OU's and I have delegated permissions to both OU's the same way. I went through ADUCs and went through the delegation wizard. I gave a group create/delete permissions as well as write for computer objects. The goal here was to give my Help Desk staff the ability to move machine between these 2 OU's. On one of the OU's they can move computers in an out. the other one they get an access denied error. This is where it gets strange. If I make a sub OU in the OU that is currently not working everything works in the sub OU's. I used powershell to get the ACL on the OU's and I found that the following is missing on the OU that is not working:

ActiveDirectoryRights : WriteProperty
InheritanceType : Descendents
ObjectType : bf96791e-0de6-11d0-a285-00aa003049e2
InheritedObjectType : bf967a86-0de6-11d0-a285-00aa003049e2
ObjectFlags : ObjectAceTypePresent, InheritedObjectAceTypePresent
AccessControlType : Allow
IdentityReference : Domain\Group
IsInherited : False
InheritanceFlags : ContainerInherit
PropagationFlags : InheritOnly

Since I went through the wizard on both OU's and selected the exact same settings I am not sure why this is missing on this one OU only. Here is a bit of a diagram to help explain my situation:

*Main OU
*Sub OU 1 - Delegated permissions here - Cannot manage computer objects here
*TestSubOU - We can manage computer objects here
*Sub OU2 - Delegated Permissions here - Can Manage computer objects here

The above posted ACL is what is missing from the OU that our help desk cannot manage. I am wondering if there is something corrupt on the OU that is not working.

Thanks,
Scott

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,246 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Fan Fan 15,326 Reputation points Microsoft Vendor
    2020-07-29T01:49:18.037+00:00

    Hi，
    Based on my understanding , even if you assign the same permission the both the sub OUs through the delegation wizard, it will be difference when you used powershell to get the ACL on the OU's,right?
    Did you check the security lab on the OU's property as following:
    14181-7294.jpg
    Can you find the permission :WriteProperty on the above page and assign permission directly ？
    If there are any updates, welcome to share it.
    Best Regards,