I tried moving an OU in Active Directory today and received an Access is denied error. Upon further inspection of my AD user account I had the necessary permission to move the object (I had full permission on the set of OUs I was working with) and I have moved items multiple times in AD over the course of my IT career; which also makes it a little odd that I just ran into this for the first time now, but nonetheless.
What I tried
- Giving my individual AD user account permission to the particular OUs as opposed to just the AD Security Group I was a part of that had permission on the OUs already
- Using a Domain Admin account to try the move
- Resetting my user account password then logging off and on and opening AD and moving the OU
- Tried connecting to a different Domain Controller and performing the move
- Tried connecting to AD through a different server with RSAT installed and performing the move
All of these ended without success.
Why can I not move an OU in Active Directory to another OU when I have full permission on both OUs?