<div>
Hi there Venurajav, thanks for that link...it is a good link but a bit hard to follow since it does not explicitly tell you what rights are needed from a source and destination OU.<br />
Im still having issues undertstanding why a move of a user object requires WRITE PERMISSION on the SOURCE OU. I thought it would only need Delete child. But when I do this, I get Access Denied.
</div>


<div>
<div class="content wysiwyg-content">
Hi everyone hope you are all well.<br />
Guys I'm having trouble with the following.<br />
<br />
I need to assign the user Bob, the right to move user accounts from OU1 to OU2.<br />
<br />
This is what I thought Bob would need:<br />
<br />
DC (Delete Child) permission on the OU named 'OU1' for user accounts.<br />
CC (Create Child) permission on the OU named 'OU2' for user accounts.<br />
<br />
I run the following 2 Dsacls commands:<br />
Dsacls &lt;path to OU1&gt; /G domain1\Bob:DC;user<br />
Dsacls &lt;path to OU2&gt; /G domain1\Bob:CC;user<br />
<br />
I then test out whether Bob can move a user from OU1 to OU2, and it fails with an Access Denied.<br />
<br />
Guys what am I missing here?<br />
I thought all I would need for bob is the ability to delete the account in OU1 and the ability to create it again in the OU2.<br />
<br />
Any help greatly appreciated.
</div>
</div>


Hi everyone hope you are all well.
Guys I'm having trouble with the following.

I need to assign the user Bob, the right to move user accounts from OU1 to OU2.

This is what I thought Bob would need:

DC (Delete Child) permission on the OU named 'OU1' for user accounts.
CC (Create Child) permission on the OU named 'OU2' for user accounts.

I run the following 2 Dsacls commands:
Dsacls <path to OU1> /G domain1\Bob:DC;user
Dsacls <path to OU2> /G domain1\Bob:CC;user

I then test out whether Bob can move a user from OU1 to OU2, and it fails with an Access Denied.

Guys what am I missing here?
I thought all I would need for bob is the ability to delete the account in OU1 and the ability to create it again in the OU2.

Any help greatly appreciated.

Hi there Venurajav, thanks for that link...it is a good link but a bit hard to follow since it does not explicitly tell you what rights are needed from a source and destination OU.
Im still having issues undertstanding why a move of a user object requires WRITE PERMISSION on the SOURCE OU. I thought it would only need Delete child. But when I do this, I get Access Denied.

Using Dsacls to assign a user the right move users from OU1 to OU2

Hi everyone hope you are all well.
Guys I&#39;m having trouble with the following.

I need to assign the user Bob, the right to move user accounts from OU1 to OU2.

This is what I thought Bob would need:

DC (Delete Child) permission on the OU named &#39;OU1&#39; for user accounts.
CC (Create Child) permission on the OU named &#39;OU2&#39; for user accounts.

I run the following 2 Dsacls commands:
Dsacls &lt;path to OU1&gt; /G domain1\Bob:DC;user
Dsacls &lt;path to OU2&gt; /G domain1\Bob:CC;user

I then test out whether Bob can move a user from OU1 to OU2, and it fails with an Access Denied.

Guys what am I missing here?
I thought all I would need for bob is the ability to delete the account in OU1 and the ability to create it again in the OU2.

Any help greatly appreciated.

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.