The rights to move the computers inside the OU without the ability to delete they from the AD

Question

But... How can I do this?

Even if I forbid deleting the computer object directly, the user can still delete the unit. If it is possible to prohibit deleting the computer, then we cannot move from folder to folder and subfolders.

Thanks for your time.

score 0 · Accepted Answer · answered Apr 21 '21 at 05:46

0

This right does not exist; moving a computer to a sibling OU, a child OU a parent OU, a different OU or container, specifically requires the delete computer object permission.

As documented here https://social.technet.microsoft.com/wiki/contents/articles/20747.delegate-moving-user-group-and-computer-accounts-between-organizational-units-in-active-directory.aspx

answered Apr 21 '21 at 05:46

Semicolon

1,775
8
7

Of course, it's a pity that this is so. Thank you for saving my time! – Alexander Shad Apr 21 '21 at 12:27

The rights to move the computers inside the OU without the ability to delete they from the AD

1 Answers1