To move computers, a user must be granted two permissions:
- Move Objects from Container (applied to Computer objects)
- Move Computer Objects to Container (applied to Container and OU objects in your scenario)
The first permission must be assigned over the computers that you want to allow moving.
The second permission must be assigned over the target OUs/containers (where computers will be moved).
- Select the Computer Manager role in the Console Tree and click Add in the Result Pane.
- In the dialog that opens, select the Computer object type in the object type list.
- In the General Permissions section, select Allow for the Move Objects From Container permission.
Users will be able to move only the computers included in the activity scope of the Computer Manager role.
Now you need to specify to which OUs/containers users will be able to move computers. It is recommended to use a separate role for this purpose.
- Run the Security Role Creation wizard.
- At the 2nd step of the wizard, click Add. The Add Permissions dialog will open.
- In the object type list, select Container and Organizational Unit.
- In the Operations on child objects list, select Allow for the Move Objects to Container permission.
- Click the Select object types link, select the Computer object type and click OK.
- At the 3rd step of the wizard, select a user or a group in the Assign to list, and click Assign.
- Select the Disabled OU, click Add and select the This Organizational-Unit object option. If you want to allow moving computers to the OUs located under the Disabled OU, select the Child objects of this Organizational Unit option.
- Click OK two times.
- Click the Assign button once again.
- In the Object Types drop-down list, select the Container object type.
- Select the built-in Computers container, click Add, configure Assignment Options, and click OK two times.