Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to Delegate User to be able to cleanup AD by allowing him to move users between couple of OU's (and doing only that). How can I achieve that?

I want to extend user permission that I've given using this method Grant permission in Active Directory to add users / modify / changed password / add them to group them but not delete them

share|improve this question
add comment

1 Answer

up vote 9 down vote accepted

The common way would be to use the "Delegation of control" wizard which is part of Active Directory Users & Computers console snapin to grant the permissions on the OUs in question.

You would have to choose the object types you want to be affected. In your case this obviously would be the "user" object type. But there is no permission for "moving", you would have to grant object creation and deletion rights for the OUs in question instead. Doing so obviously would allow for user object deletions as well, but this is how it works - a move is a create/delete operation. See Microsoft knowledge base article KB818091 for a detailed reference.

share|improve this answer
    
Well yes, which options to choose. There's a million of options to choose from in Custom task delegation. I need to grant only this right and nothing else. –  MadBoy Dec 17 '11 at 20:36
    
I believe they'll need create and delete (basically, full control) for the object types that they'll be moving. –  Shane Madden Dec 17 '11 at 20:45
    
The million of options is mainly to choose the object types you want to be affected. In your case this obviously would be the "user" object type. But there is no permission for "moving", you would have to grant object creation and deletion rights for the OUs in question instead. –  the-wabbit Dec 17 '11 at 20:51
    
Wouldn't he be able to delete user then as well ? –  MadBoy Dec 17 '11 at 20:54
    
Yes, but this is how it works - a move is a create/delete operation. See KB818091. –  the-wabbit Dec 17 '11 at 21:50
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.