Permissions Required to move Computers

Question

I have a root OU that I created called Disabled. I want to give the Computer Manager role the necessary permissions to move a computer to any OU/sub tree desired. They can move them to the root, built-in computer OU but nothing else. What Permissions do I need to give them? Thanks!

Answer 1

Hello,

To move computers, a user must be granted two permissions:

1. Move Objects from Container (applied to Computer objects)
2. Move Computer Objects to Container (applied to Container and OU objects in your scenario)

The first permission must be assigned over the computers that you want to allow moving.
The second permission must be assigned over the target OUs/containers (where computers will be moved).

1. Select the Computer Manager role in the Console Tree and click Add in the Result Pane.
2. In the dialog that opens, select the Computer object type in the object type list.
3. In the General Permissions section, select Allow for the Move Objects From Container permission.
   

Users will be able to move only the computers included in the activity scope of the Computer Manager role.

Now you need to specify to which OUs/containers users will be able to move computers. It is recommended to use a separate role for this purpose.

1. Run the Security Role Creation wizard.
2. At the 2nd step of the wizard, click Add. The Add Permissions dialog will open.
3. In the object type list, select Container and Organizational Unit.
4. In the Operations on child objects list, select Allow for the Move Objects to Container permission.
5. Click the Select object types link, select the Computer object type and click OK.
   
6. At the 3rd step of the wizard, select a user or a group in the Assign to list, and click Assign.
7. Select the Disabled OU, click Add and select the This Organizational-Unit object option. If you want to allow moving computers to the OUs located under the Disabled OU, select the Child objects of this Organizational Unit option.
   
8. Click OK two times.
9. Click the Assign button once again.
10. In the Object Types drop-down list, select the Container object type.
    
11. Select the built-in Computers container, click Add, configure Assignment Options, and click OK two times.
    

Comments

See also Grant Rights to Move Users Between OUs.

---

Thank you working great!

---

Hi

I have followed this instruction, but with groups as targets.

I have a Security role with following permission:
- Move Objects From Container (Apply to Group).
- Move Objects From Container (Apply to Organizational-Unit)
- Move Group Objects To Container (Apply To Organizational-Unit)

But I get an Access Denied when trying to move a group within the scope.
I'm member of the Security Role.

Do I need more permissions ?

- Thanks

---

Hello,

Could you provide us with a screenshot of Security Role with Assignments? We need something like the following:

Also, could you post here or send us names of source and target containers (e.g. example.com\Departments\IT) for group move action?

---

"Assistant" attribute on the groups are working in another situation.

Groups are to be moved within a limited scope, like:
-Groups
-- Category1
-- Category2
-- Category3

The "assistant" should be able to move his groups from eg. Category1 to Category3.

Thanks

---

Hello,

The issue occurs because in case of move operation permissions of the Trustee (Assistant in your case) are checked twice. Before moving a group from an OU, Adaxes checks whether the initiator is the Assistant of the group, then before moving to the OU, Adaxes checks whether the initiator is the Assistant of the OU. As long as OUs have no Assistants, Adaxes returns Access Denied error. To remedy the issue, you need to create another Security Role that will allow all users to move groups to the OUs under Groups OU. The role will be like the following:

As long as this role allows all users to move groups to the OUs, it can happen so that a user that is not an Assistant of a group (but has permissions to move groups from other OUs) moves it to one of the OUs under Groups OU. To avoid such situations, you can create a Business Rule that will cancel such invalid move operations. If you need this, we will provide you with detailed instructions.

---

Yes, works :D :D :D

- Thanks