How do I let admins only delete the OUs they created?

I'm trying to get a controlled AD designed & implemented, but I'm running into a few problems with delete rights in a Windows 2003 AD.

My situation is this: Each physical branch office is going to relate to an OU in the AD. There will be a parent OU, lets call it MASTER, with an OU for each branch office, so let's say OU1, OU2, OU3, and OU4. That's the default set of OUs each branch will receive. I want to delegate so that the each branch admin can, if they so desire, either create more new OUs directly in the branch OU, or create more new OUs in one of either OU1, OU2, OU3, or OU4. I want them to be able to delete whatever they have created themselves, but I **DONT** want them to create any of the defaut set (OU1/2/3/4). I've tried assigning various permutations, such as allowing full control on the branch OU, but explicit deny permissions on the standard OU set, but nothing seems to work because of the way Windows 2003 processes the inherited vs explicit permissions set.

Its proving very annoying!

Thanks for your help
Who is Participating?
LauraEHunterMVPConnect With a Mentor Commented:
Go to the Properties tab of OU1, OU2, OU3, OU4. Click Advanced from the Security tab and look for the option to configure security settings that apply to "Child objects only" - this will confer rights to create objects underneath Ou1/2/3/4 without the user having rights to modify or delete the OU itself.  You'll have to do this 4 times, once for each of ou1/2/3/4.

Hope this helps.

Laura E. Hunter - Microsoft MVP: Windows Server - Networking
tbennett35Author Commented:
Laura Hunter...well well well...I bought your book!

Got to hand it to you...that must probably be about the only thing I didn't try, because I was ripping my hair out yesterday! It worked a treat!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.