Hi dear friends
This is my problem:
I have logged to my account by an administrative previledeges. In fact I'm the administrator, but when I try to move an OU to another OU I receive the ACCESS DENIED warning .
Is it related to GPO settings or something related to it?
I was wandering if you could help me to find out what the problem is.
Thanks for your attention
----------------------------------
آيا دامين ادمين هستي؟
Thanks dear Saeid for your attention, but I found the answer. I found it informative. I hope it helps other members
[COLOR=#000000][FONT=Arial][B]Remove Protection Against Accidental Organizational Unit Deletion[/B][/FONT][/COLOR]
Updated: January 7, 2010
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
You can use this procedure to remove the following access control entries (ACEs):
[LIST][*]On the organizational unit (OU) for which you are removing protection, remove explicit Deny ACEs for the Delete and Delete Subtree advanced permissions for the Everyone group.[*]On the parent container of the OU for which you are removing protection, remove an explicit Deny ACE for the Delete All Child Objects permission for the Everyone group.[/LIST]This removes protection that prevents an OU from accidental deletion. Consequently, you may have to remove these permissions to be able to perform bulk deletions of objects in Active Directory.
To add the protection back again, you can reselect the [B]Deny[/B] check boxes for the Delete and Delete Subtree advanced permissions for the Everyone group for the OU and the Delete All Child Objects permission for the Everyone group on the parent container. For more information, see [URL="http://technet.microsoft.com/en-us/library/cc739350(WS.10).aspx"]Protect an Organizational Unit from Accidental Deletion[/URL].
Membership in the Domain Admins group, or equivalent, is required to complete this procedure.
[h=4]To remove protection that prevents an OU from accidental deletion[/h]
[LIST][*]Log on to the computer as a member of the Domain Admins group.[*]Open Active Directory Users and Computers.[*]Click [B]View[/B], and then click [B]Advanced Features[/B].[*]First, clear permissions on the OU for which you want to remove protection. To do this, right-click the OU, and then click [B]Properties[/B].[*]In [I]OU[/I][B] Properties[/B], click the [B]Security[/B] tab, and then click [B]Advanced[/B].[*]In [B]Permission Entries[/B], select the [B]Deny[/B] entry for the [B]Everyone[/B] group, and then click [B]Remove[/B].[*]Click [B]OK[/B] to close the [B]Advanced Security Settings[/B], and then click [B]OK[/B] to close [I]OU[/I][B] Properties[/B].[*]Second, clear permissions on the parent container of the OU for which you want to remove protection. To do this, right-click the parent container, and then click [B]Properties[/B].[*]In [I]Container[/I][B]Properties[/B], click the [B]Security[/B] tab.[*]In Group or user names, select the [B]Everyone[/B] group, and then clear the [B]Deny[/B] check box for [B]Delete All Child Objects[/B], and then click [B]OK[/B] to close [I]Container[/I][B] Properties[/B].
Best Regards[/LIST]
