Delegate help desk users permission to move users and computers object to OU on entire domain

Question

Hi, I have created a delegated permissions to allow help desk users to move users/computers to differen OUs,but I got this kind of messages: ![232655-image.png][1] For computers I applied these permissions, with almost the same message: ![232627-image.png][2] I also looked up some information that recommends to disable "protect object from accidental deletion" on the OUs, but it did not work. I tested with different permission but non of them are working. Is there anything else I can apply? [1]: /api/attachments/232655-image.png?platform=QnA [2]: /api/attachments/232627-image.png?platform=QnA

Answer 1

Hi

To be able to move objects from one OU to another you needs to have rights to both create and delete of the object type in both the source and target OU. You will also need the rights to update the object properties. If you set these permissions on the top most OU all the child OUs will also inherit the permissions.

There are a couple of options to delegate the permissions, you could provide the helpdesk team with full control over the user or computer objects and the child objects.

This will grant the following permissions to the grp_MoveComputerObjets group on the top OU, this will be needed to be assigned on both the source and target OUs.

This does assign more rights than is actually needed to move a computer or user objects. You can change the Full Control to Write all Properties by setting the permissions to this:

Which results in these permissions:

][6]

If you want the absolute bear minimum permissions required, you only need write to the name and cn attributes to complete the move. These can't be set by the delegation wizard, and have to be set manually.

Gary.

Answer 2

I created a group and gave it the ability to write all properties as well as create/delete. I cannot move the object, I get access denied. Any ideas? I can move it OUT of an OU (I can move it to that OU).