Active Directory Permissions: Delete vs Move

active-directorydelegationpermissions

I want our help desk to be able to move user accounts but NOT delete them. Here is the summary of our current permissions set on the affected OU's (this DOES allow them to delete user accounts):

  • Allow – Full Control – Descendant User objects
  • Allow – Create/Delete User objects – This object and all descendent objects

If I change that top row by editing the ACE and unchecking the "Delete" box, I get my desired result of the help desk being unable to delete user objects. However then they get Access Denied errors when they try to move users between OUs.

Is what I want possible? Does Microsoft seriously not distinguish moves versus deletions?

Best Answer

Logically a "move" is a copy (or in filesystem parlance a hard link) followed by a delete: you can't move something if you can't remove it from its original location.

So no, Microsoft doesn't distinguish between "move" and "delete" because in order to do the former you must, by necessity, do the latter.

If you want to prevent accidental deletion of user accounts/objects within AD you can set them to "Protect object from accidental deletion" either manually on the Object tab of the user in ADUC:

enter image description here

or you can script it for every user object in AD all at once:

Get-ADObject -filter {(ObjectClass -eq "user")} | Set-ADObject -ProtectedFromAccidentalDeletion:$true
Related Topic