Grant Rights to Move Users Between OUs
To move Active Directory objects from one Organizational Unit (OU) to another, a user must be granted two rights:
- Move Objects From Container
- Move Objects To Container.
If a user is granted the Move Objects From Container right for an AD object, then the user can move the object out of its current OU. If a user is granted the Move Objects To Container right for an OU, then the user can move AD objects to that OU.
The Move Objects From Container right must be assigned for the AD objects that you want to allow moving. The Move Objects To Container right must be assigned for the OUs to which you want to allow moving objects. Depending on your requirements, sometimes it is better to use two Security Roles to delegate the permissions - one role will grant the Move Objects From Container right, and the other role will grant the The Move Objects To Container right.
In this tutorial you will learn how to create a Security Role that will grant the permissions necessary to move user accounts, and how to assign the role to users or groups so that they could move user accounts to/from specific OUs only.
-
Click the Add button.
The Add Permissions dialog will open. -
Select User in the list of object types, to which permissions are applied.
Check the Move Objects From Container permission in the Allow column of
the General permissions section.
- Click OK.
-
Click the Add button again to open the Add Permissions dialog.
-
Select Organizational-Unit in the list of object types, to which permissions are applied.
In the Operations on child objects section, check the Move Objects To Container
permission in the Allow column.
If you want to allow moving users to containers (e.g. built-in container Users), also select the Container object type in the list of object types.
-
To allow moving only user objects, click Select object types and select User as
shown in the figure below. Click OK.
When you select child object types, you specify which types of objects users will have the right to move. -
Optionally, add the Read permission
It is reasonable to add the Read - All object types permission to every Security Role, as this permission allows browsing Active Directory. By default, the permission is granted by the Domain Users built-in Security Role. However, if that Security Role is disabled, users will not be able to view any objects in Active Directory.To add the Read - All object types permission, click the Add button. In the Add Permissions dialog, select the Read permission in the Allow column of the General permissions section. Click OK.
- Click OK.
.
You can enter only some starting characters of the object's name and use an asterisk
(*) as a wildcard.Example: admin for Administrator, *admin* for MyAdminGroup.
Clicking the Assign button will display the Role Activity Scope dialog. Here you need to specify which user accounts can be moved to which OUs by the users or groups selected on the previous step (trustees).
If an assignment includes a user account, the trustees will have the permission to move that user account out of its OU. If an assignment includes an OU, the trustees will have the permission to move users to that OU.
You can select one of the following items:-
All Objects - select if you want the trustees to be able to move any user account to
any OU in any AD domain managed by Adaxes.
-
Specific Domain - select if you want the trustees to be able to move any user account
to any OU in the AD domain you specify. When selected, you will need to specify
the assignment scope in the Assignment Options dialog.
Assignment Options
In the Assignment Options dialog select the All objects in this Domain option and click OK.
-
OU or Container - select a specific Organizational Unit or container if you
want to allow the trustees to either move out the user accounts located under the selected
OU/container, or move user accounts to that OU/container. The applied permission will depend
on the assignment scope that you will need to specify in the Assignment Options dialog.
Assignment Options
To allow the trustees to move user accounts to the selected OU, select This Organizational-Unit object.
To allow the trustees to move the user accounts located under the selected OU out of this OU, select the Child objects of this Organizational-Unit option.
To allow moving only the user accounts located directly under the selected OU, enable the Immediate child objects only option.
If the selected OU has child OUs, the assignment will also allow the trustees to move users to the child OUs. If you don't need that, you can create a separate Security Role that will grant a single permission - Move Objects From Container and assign the role over the OU. -
Group - select a specific group if you want to allow the trustees to move the user
accounts that are members of the group. If you select a group, you will
need to specify the assignment scope in the Assignment Options dialog.
Assignment Options
In the Assignment Options dialog select the Members of this Group option. To allow moving only the users that are direct members of the selected group, enable the Direct members only option. Click OK.
-
Business Unit - select a Business Unit if you want to allow the trustees to move
the user accounts that are members of a specific Business Unit. To view available
Business Units, select the Business Units item in the Look in drop-down
list.
If you select a Business Unit, you will need to specify the assignment scope in the Assignment Options dialog.
Assignment Options
In the Assignment Options dialog select the Members of this Business Unit option and click OK.
If the selected Business Unit includes OUs, the assignment will also allow the trustees to move users to the OUs.
Select the object you need and click Add. When finished, click OK.