Re: Permission to deny moving of OU objects

Technology is no substitute for proper training. If they need to be able to
create objects in all OUs, but not move OUs they need to be trained as to
what their job is. If they can't do the job.........

hth
DDS


"Anthony" <anthony.spam@xxxxxxxxxxxxxx> wrote in message
news:%23Y5%23Ybu%23HHA.1184@xxxxxxxxxxxxxxxxxxxxxxx
This is what's called a dilemma.
Anthony,
http://www.airdesk.co.uk




"Dylan" <Dylan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:ACD4A58E-0E9E-4A03-8EC8-F945C01CD44D@xxxxxxxxxxxxxxxx
Thanks for the quick reply. Unfortunately, this particular goup in
question
needs to be able to create objects in all OUs including OU objects.

"Anthony" wrote:

You'd have to make it so that admins of OU1 have no right to create
objects
in OU2. Then they can't move it there.
Accidentally moving a country OU seems like a big step, and I would be
restricting admin rights to people who know what they are doing,
Anthony,
http://www.airdesk.co.uk




"Dylan" <Dylan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:964CE946-8F63-42B2-8C15-8C0FB3F687F2@xxxxxxxxxxxxxxxx
Hi,

We have a single domain structure with multip OUs under Root domain to
separate sites in different location. For example:

company.com
|_CA
|_NV
|_AZ
|_CO

I've set Deny Delete of Organizational Unit to "This Object and all
Child
Objects" for Root domain as well as site OUs for a particular group.
Is
there a way to set permission so the same group cannot move the OU to
under
another OU? There have been accidents where one OU was moved under
another
OU and Deny Delete OU object doesn't prevent that from happening.

Any suggestions?

Thanks.







.

Relevant Pages

  • Re: Permission to deny moving of OU objects
    ... Accidentally moving a country OU seems like a big step, ... separate sites in different location. ... I've set Deny Delete of Organizational Unit to "This Object and all ... Objects" for Root domain as well as site OUs for a particular group. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Permission to deny moving of OU objects
    ... You'd have to make it so that admins of OU1 have no right to create objects ... Accidentally moving a country OU seems like a big step, ... I've set Deny Delete of Organizational Unit to "This Object and all Child ... Objects" for Root domain as well as site OUs for a particular group. ...
    (microsoft.public.windows.server.active_directory)
Loading