I have the following OU structure in Active Directory:
I've followed this article here to delegate moving user objects permissions to a group. Moving from the Source OU 'DisabledUsers' to Destination OU 'OfficeA/Sector1' worked fine.
I've set the same permissions, this time in 'OfficeA' as being the source AND destination OU, so the group could move users from one child OU to another, like from 'Sector1' to 'Sector2'. But this fails, I'm getting Acess Denied.
Is this because I set all the permissions as source and destination in a single OU? I can't really figure it out. I just needed the group to move users around child OU's of 'OfficeA'.
Also, is there a way to better track what's blocking an AD operation, it just throws "Acess denied", there are SO many properties to figure out...