Active Directory management & automation

Grant Rights to Move Users Between OUs

To move Active Directory objects from one Organizational Unit (OU) to another, a user must be granted two rights:

  • Move Objects From Container
  • Move Objects To Container.

If a user is granted the Move Objects From Container right for an AD object, then the user can move the object out of its current OU. If a user is granted the Move Objects To Container right for an OU, then the user can move AD objects to that OU.

The Move Objects From Container right must be assigned for the AD objects that you want to allow moving. The Move Objects To Container right must be assigned for the OUs to which you want to allow moving objects. Depending on your requirements, sometimes it is better to use two Security Roles to delegate the permissions - one role will grant the Move Objects From Container right, and the other role will grant the The Move Objects To Container right.

In this tutorial you will learn how to create a Security Role that will grant the permissions necessary to move user accounts, and how to assign the role to users or groups so that they could move user accounts to/from specific OUs only.

Launch Adaxes Administration Console, right-click your Adaxes service, point to New and click Security Role . The Create Security Role wizard will open.

Launching the Create Security Role wizard

Enter a name for the new Security Role and click Next.

To add a permission that will allow moving user accounts out of OUs (Move Objects From Container):
  • Click the Add button.
    Create Security Role - Step 2
    The Add Permissions dialog will open.
  • Select User in the list of object types, to which permissions are applied. Check the Move Objects From Container permission in the Allow column of the General permissions section.
    Add 'Move Objects From Container' Permission
  • Click OK.

To add a permission that will allow moving user accounts to OUs (Move Objects To Container):
  • Click the Add button again to open the Add Permissions dialog.
  • Select Organizational-Unit in the list of object types, to which permissions are applied. In the Operations on child objects section, check the Move Objects To Container permission in the Allow column. Add 'Move Objects To Container' Permission
    If you want to allow moving users to containers (e.g. built-in container Users), also select the Container object type in the list of object types.
  • To allow moving only user objects, click Select object types and select User as shown in the figure below. Click OK.

    When you select child object types, you specify which types of objects users will have the right to move.
  • Optionally, add the Read permission

    It is reasonable to add the Read - All object types permission to every Security Role, as this permission allows browsing Active Directory. By default, the permission is granted by the Domain Users built-in Security Role. However, if that Security Role is disabled, users will not be able to view any objects in Active Directory.

    To add the Read - All object types permission, click the Add button. In the Add Permissions dialog, select the Read permission in the Allow column of the General permissions section. Click OK.

    Specify additional permissions

  • Click OK.

In the Role Permissions window you can see the permissions you have just added. Click Next.

On the Assign Role page select users or groups to which you want to allow moving user accounts.
To quickly find a user or group, type its name in the search field and click . You can enter only some starting characters of the object's name and use an asterisk (*) as a wildcard.
Example: admin for Administrator, *admin* for MyAdminGroup.
Role assignments

Clicking the Assign button will display the Role Activity Scope dialog. Here you need to specify which user accounts can be moved to which OUs by the users or groups selected on the previous step (trustees).

If an assignment includes a user account, the trustees will have the permission to move that user account out of its OU. If an assignment includes an OU, the trustees will have the permission to move users to that OU.

You can select one of the following items:
  • All Objects - select if you want the trustees to be able to move any user account to any OU in any AD domain managed by Adaxes.

  • Specific Domain - select if you want the trustees to be able to move any user account to any OU in the AD domain you specify. When selected, you will need to specify the assignment scope in the Assignment Options dialog.

    Assignment Options

    In the Assignment Options dialog select the All objects in this Domain option and click OK.

    Assignment Options for a Specific Domain

  • OU or Container - select a specific Organizational Unit or container if you want to allow the trustees to either move out the user accounts located under the selected OU/container, or move user accounts to that OU/container. The applied permission will depend on the assignment scope that you will need to specify in the Assignment Options dialog.

    Assignment Options

    To allow the trustees to move user accounts to the selected OU, select This Organizational-Unit object.

    To allow the trustees to move the user accounts located under the selected OU out of this OU, select the Child objects of this Organizational-Unit option.

    To allow moving only the user accounts located directly under the selected OU, enable the Immediate child objects only option.

    If the selected OU has child OUs, the assignment will also allow the trustees to move users to the child OUs. If you don't need that, you can create a separate Security Role that will grant a single permission - Move Objects From Container and assign the role over the OU.
  • Group - select a specific group if you want to allow the trustees to move the user accounts that are members of the group. If you select a group, you will need to specify the assignment scope in the Assignment Options dialog.

    Assignment Options

    In the Assignment Options dialog select the Members of this Group option. To allow moving only the users that are direct members of the selected group, enable the Direct members only option. Click OK.

    Assignment Options

  • Business Unit - select a Business Unit if you want to allow the trustees to move the user accounts that are members of a specific Business Unit. To view available Business Units, select the Business Units item in the Look in drop-down list.

    Viewing Business Units

    If you select a Business Unit, you will need to specify the assignment scope in the Assignment Options dialog.

    Assignment Options

    In the Assignment Options dialog select the Members of this Business Unit option and click OK.

    Assignment Options

    If the selected Business Unit includes OUs, the assignment will also allow the trustees to move users to the OUs.

Select the object you need and click Add. When finished, click OK.

The assignments will be displayed in the Assignments list. To add assignments to other users or groups, repeat steps 6 and 7. Click Finish.
Distribution of permissions with the help of Security Roles does not modify Active Directory native permissions.
? Waiting

Progress status: Checking...