0

I have the following OU structure in Active Directory:

-Domain

--DisabledUsers

--OfficeA
---Sector1
---Secotr2

--OfficeB
---Sector1
---Sector2

I've followed this article here to delegate moving user objects permissions to a group. Moving from the Source OU 'DisabledUsers' to Destination OU 'OfficeA/Sector1' worked fine.

I've set the same permissions, this time in 'OfficeA' as being the source AND destination OU, so the group could move users from one child OU to another, like from 'Sector1' to 'Sector2'. But this fails, I'm getting Acess Denied.

Is this because I set all the permissions as source and destination in a single OU? I can't really figure it out. I just needed the group to move users around child OU's of 'OfficeA'.

Also, is there a way to better track what's blocking an AD operation, it just throws "Acess denied", there are SO many properties to figure out...

2 Answers 2

1

Permissions required to move a user object are: Delete permissions on users in the source Create permissions on users in the destination

In some companies I have worked for, a Deny delete rule is in place that must be removed before the user is able to move objects.

Determine if the user has Delete effective permissions:

  1. Ensure ADUC is running in Advanced Mode

  2. Right click on the object that you are attempting to move and select properties

  3. On the Security Tab, click advanced

  4. Move the Effective Permissions tab

  5. Select the user that will be performing the move

  6. Look for the Delete permission and Delete user permission

To identify the source of the permission:

  1. Navigate back to the Permissions tab

  2. Sort by Type

  3. See if any Deny permissions exist, inherited from will tell you where the permission is set.

2
  • That's it, finally! For some reason, some child OU's had Deny permission to Everyone to Delete ALL kind of objects, and was masked under the permission set from "Protect from deletion" checkbox at the OUs. Thats why I could not see anything different from the OUs that worked. The object was ok, it was on the OU itself. But the Effective Permissions was crucial to realize that.
    – esserafael
    Oct 1, 2015 at 17:43
  • First I thought it had something to do with the "Protect from deletion" checkbox messing things up, but unchecking it doesnt make a difference. I had to manually remove the Deny permission, then re-check the "Protect from deletion" checkbox, where it sets only "Delete" and "Delete subtree" permissions, then it works now.
    – esserafael
    Oct 1, 2015 at 17:44
1

Is this because I set all the permissions as source and destination in a single OU?

Yes, almost certainly. The security principals that are performing the move need permission to delete User objects (and several other permissions) on the specified Source OU's, and permission to create User objects on the Destination OU's.

You need to grant that permission at a high enough level that covers the child OU's in scope, or grant the permission to each source/destination OU.

3
  • Thanks for the answer. Well, I did grant the permissions at the highest level I could, at the "OfficeA" in the example. So at the "OfficeA" I've set create/delete user objects and all the other permissions, its applying to all descendant objects (I checked the security of children OU's and its applying). But I still cant move a user from "Sector1" to "Sector2" inside "OfficeA". I can move from "DisabledUsers" to any child OU of "OfficeA" though ("DisabledUsers" set with "Source" permissions), it's driving me crazy heh.
    – esserafael
    Sep 30, 2015 at 18:20
  • Check if accounts in Sector1/2 Advanced permissions have the box unchecked for Inherit permissions, or any Deny entries.
    – Greg Askew
    Sep 30, 2015 at 18:43
  • Yes it's inheriting ok. Now I noticed some pattern on whats going on. If the source OU is the LAST OU in the tree(no other OU inside it), I can move user from it, to any other child OU of "OfficeA". (So the destinations are ok). If the source OU have any child OU, I get access denied. Weird. I'll keep testing things...
    – esserafael
    Sep 30, 2015 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.