Share via

Delegation permission to move the users in different OU but restrict user creation and deletion

HAFIZ AHMED A 0 Reputation points
2025-11-27T06:27:19.65+00:00

I would like to request clarification regarding specific permission requirements in Active Directory for allowing IT Support staff to move user objects between OUs without granting create or delete permissions.

We have the following doubts and need confirmation from Microsoft:

Required Permissions for MOVE Operation:

Documentation states that MOVE requires:

     `DELETE_CHILD` on source OU (or `DELETE` on the object)
     
           `WRITE_PROP` on the object for `RDN` and `CN`
           
                 `CREATE_CHILD` on destination OU
                 
                    We want to allow **MOVE only**, but **do NOT want to allow create or delete of user accounts**.
                    
                       Please confirm if this is technically possible and supported.
Microsoft Security | Microsoft Authenticator

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Q&A Assist
    2025-11-27T06:27:28.68+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    In Active Directory, to allow IT Support staff to move user objects between Organizational Units (OUs) without granting permissions to create or delete user accounts, you need to carefully manage the permissions assigned to them.

    For the MOVE operation, the following permissions are indeed required:

    • DELETE_CHILD permission on the source OU (or DELETE permission on the object being moved).
    • WRITE_PROP permission on the object for the Relative Distinguished Name (RDN) and Common Name (CN).
    • CREATE_CHILD permission on the destination OU.

    However, if you want to restrict the ability to create or delete user accounts while still allowing the MOVE operation, you can achieve this by:

    1. Granting the necessary permissions for the MOVE operation as listed above.
    2. Explicitly denying the CREATE and DELETE permissions on the user objects themselves within the OUs.

    This setup allows the IT Support staff to move users between OUs while preventing them from creating or deleting user accounts. Therefore, it is technically possible and supported to configure these permissions in such a way that only the MOVE operation is allowed without granting create or delete permissions.

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.