Delegating object moves within OUs and SubOUs
I have successfully delegated rights to another group to move computer objects of one OU to their assigned OU. Unfortunately, the group is unable to move objects within their assigned OU to a subOU. I was under the assumption that rights were inherited from Parent OU. The delegated group has rights to create OUs, so it seems strange that this would not work.
March 21st, 2011 12:48pm

I think I may have answered my own question. It appears that the permissions have to be explicitly granted Full Control for computer objects> also, I foung it easier to simply use the delegation wizard to apply perms rather than mucking through those ACLs.
Free Windows Admin Tool Kit Click here and download it now
March 21st, 2011 2:50pm

Hi, To move computer objects between OUs, you do not need to grant full control permission for computer objects. You can use the following steps to grant a group to control the two OUs. Then, members in this group could move computer objects between these two OUs. 1. In ADUC, right click the first OU and select Delegate Control. 2. Add the group you want. 3. Select the "Create a custom task to delegate" option and click Next. 4. Select "Only the following objects in the folder". 5. Check the box before "Computer objects" in the list. 6. Check the box before "Create selected objects in this folder" and "Delete selected objects in this folder". Click Next. 7. Check the box for "Write". 8. Click Next and Finish. 9. Perform the same steps on another OU. After that, members in this group could move computer objects between these two OUs or to their SubOUs. Hope this helps. Regards, Bruce This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
March 21st, 2011 10:15pm

Hello Bruce, I seen your post previously but it didn't seem to work for me using just write. I had to check off 'full control' of computer objects. Is this suppose to work in win2k8 R2?
Free Windows Admin Tool Kit Click here and download it now
March 23rd, 2011 10:49pm

Hi, I have tested on Windows Server 2008 R2 and it did not work. Thanks for your feedback. You can keep the current status. Have a nice day. Regards, BruceThis posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
March 24th, 2011 7:07am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics