I've been trying to solve this mystery for a couple of days but I think I've reached a dead end.
We have delegated user creation and administration to a group. This permissions are applied to a Grandparent OU and inherited to a Parent OU and a Child OU, they include everything except for Full Control and Delete (Delete subtree is marked though).
Users from the group can create and modify users on all OUs, they can, however, only delete users from the Child OU (the last level). If they try to the delete a user from the other OUs they get an access denied error.
Things I've already checked:
- "Protect object from accidental deletion" isn't checked.
- Compared the effective permissions using objects from the different OUs, they are identical and don't include the Delete permission but do include the Delete subtree permission.
- Exported the ACLs of users from the different OUs using dsacls.exe. The files are identical.
Weird things I've seen so far:
- On the Root OU there's a explicit Deny delete (apply to descendant users objects). Shouldn't this also prevent deleting users from the Child OU?
I'm guessing this has something to do with the Delete subtree permission but I haven't found much info about it. Just one more bit, the domain functional level is 2008 R2, if that helps.