Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Cannot move computer obect between OU's

Posted on 2014-03-25
10
4,023 Views
Last Modified: 2014-03-31
I have two users who are members of a Global Security Group that I assigned permissions to Create/Delete Computer Objects for our entire Active Directory domain. However, they get the error message "Access is denied" when trying to move the objects. They can create a computer object in both OU's as well as delete them, just not move from one to the other. I even tried assigning explicit Create/Delete Computer Objects to the user which resulted in the same error message. I verified the permissions are replicated down to the individual OU's that they are trying to move computers in between. Is there some other permission I am missing?

AD Permissions
0
Comment
Question by:RankenIS
  • 6
  • 3
10 Comments
 
LVL 19

Expert Comment

by:Raheman M. Abdul
ID: 39953228
Check on each source and destination OU if you got the following :

1. Delete Child Objects of the Computer Class in the source OU
2. Create Child Objects of the Computer Class in the target OU
0
 

Author Comment

by:RankenIS
ID: 39953278
I just applied "Create all child objects" and "Delete all child objects" to the Descendant Computer Objects of each OU. I still get the access is denied error message.
0
 
LVL 19

Expert Comment

by:Raheman M. Abdul
ID: 39953318
1. Enable Advanced Features
2. Open computer properties then select Object tab  
3. Disable "Protect object from accidental deletion" option

I guess you are trying to move objects within a forest.
1
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:RankenIS
ID: 39953334
The OU's are in the same domain. I've tried different computer objects, even the objects the users just added to the domain. None of the computers objects have the attribute "Protect object from accidental deletion" enabled.
0
 
LVL 19

Expert Comment

by:Raheman M. Abdul
ID: 39953342
Logon to the server and check if you can move with the user accounts, there is something blocking the move.
0
 

Author Comment

by:RankenIS
ID: 39953360
Same result. I logged into the domain controller as one of the affected users.
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 39955345
Some confusion here

Are you trying to move computer objects from one OU to another
1st question is how those computers are get in those OUs as when you join the computers to domain, they will default created in Computers container

If you are trying to move these computers from default computer container, then permissions mentioned above must be granted to global group on default computers container as well, then only you can able to move them from default computers container to required OU
Also grant that global group "add workstation to domain" user rights through default domain policy\local polices\user right assignment

Now if you are trying to  move computers which are already exists between specific OUs, then please do the replication 1st and ensure that delegated rights are replicated to all Domain controllers in domain and then check if its working

Mahesh.
0
 

Author Comment

by:RankenIS
ID: 39956178
I am trying to move computers from the default computer OU into another OU. I have applied various permissions to the root of the domain and verified they are inherited down to both OU's I am working in. The user has permissions to add workstations to the domain though group policy.

Here are the two permission scenarios I have tried:

1. Applied on the domain root
          Apply to: Descendant Computer Objects
                    Create all child objects
                    Delete all child objects

2. Applied on the domain root
          Apply to: This object and all descendant objects
                    Create computers objects
                    Delete computers objects

The user can manually create and delete computer objects in the two OU's. The weird thing is, he can't move the computer object he created between them.
0
 

Accepted Solution

by:
RankenIS earned 0 total points
ID: 39956283
0
 

Author Closing Comment

by:RankenIS
ID: 39966124
Found the solution in another thread.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

792 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question