Rights needed to move computer objects between OUs

Gurus,

In order to move computer objects out of the default Computers container and
into various OUs, or to move computer objects between OUs, what kind of
rights do you need? I need to be able to delegate this task to my helpdesk
staff.

--
Spin

Hello Spin,

They need the right to "create" the object in the destination container/OU
and "delete" the object in the source container/OU.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Gurus,
>
> In order to move computer objects out of the default Computers
> container and into various OUs, or to move computer objects between
> OUs, what kind of rights do you need? I need to be able to delegate
> this task to my helpdesk staff.
>
> --
> Spin

this is quite a pain to delegate....

what you could do:
* assign delete/create for computer accounts in the computers container to
all computer (accounts) admins
* assign delete/create for computer accounts in the OU managed by some admin
group to that admin group only

the users container is in the case of move computer account between OUs the
intermediate location where on e admin moves the account into and the other
moves it out there to his OU

if you want to have a GPO applied to those computers that are initially
joined or being moved between OUs, create another intermediate OU and
redirect the default computers container to that OU. Link the GPO to that OU

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
"Spin" <Spin@invalid.com> wrote in message
news:6j2l6vF170jiU1@mid.individual.net...
> Gurus,
>
> In order to move computer objects out of the default Computers container
> and into various OUs, or to move computer objects between OUs, what kind
> of rights do you need? I need to be able to delegate this task to my
> helpdesk staff.
>
> --
> Spin
>

Hello,

You can also directly join to the good ou:
NETDOM JOIN machine /Domain:domain [/OU:ou path] [/UserD:user]
[/PasswordD:[password | *]]
[UserO:user] [/PasswordO:[password | *]]
[/REBoot[:Time in seconds]]

/OU Organizational unit under which to create the machine account.
This must be a fully qualified RFC 1779 DN for the OU.
If not specified, the account will be created under the default
organization unit for machine objects for that domain.



--
Cordialement,
Mathieu CHATEAU
English blog: http://lordoftheping.blogspot.com
French blog: http://www.lotp.fr

"Spin" <Spin@invalid.com> a écrit dans le message de
news:6j2l6vF170jiU1@mid.individual.net...
> Gurus,
>
> In order to move computer objects out of the default Computers container
> and into various OUs, or to move computer objects between OUs, what kind
> of rights do you need? I need to be able to delegate this task to my
> helpdesk staff.
>
> --
> Spin
>

Else, as explained by Meinolf Weber here
Rights needed to move computer objects between OUs
They need the right to "create" the object in the destination container/OU
and "delete" the object in the source container/OU.

and in the same thread by Jorge de Almeida Pinto :

what you could do:
* assign delete/create for computer accounts in the computers container to
all computer (accounts) admins
* assign delete/create for computer accounts in the OU managed by some admin
group to that admin group only

the users container is in the case of move computer account between OUs the
intermediate location where on e admin moves the account into and the other
moves it out there to his OU

if you want to have a GPO applied to those computers that are initially
joined or being moved between OUs, create another intermediate OU and
redirect the default computers container to that OU. Link the GPO to that OU

--
Cordialement,
Mathieu CHATEAU
English blog: http://lordoftheping.blogspot.com
French blog: http://www.lotp.fr

"Spin" <Spin@invalid.com> a écrit dans le message de
news:6j2l6vF170jiU1@mid.individual.net...
> Gurus,
>
> In order to move computer objects out of the default Computers container
> and into various OUs, or to move computer objects between OUs, what kind
> of rights do you need? I need to be able to delegate this task to my
> helpdesk staff.
>
> --
> Spin
>