Bruce
Wed Mar 26 14:57:28 PDT 2008
(Repeated from the thread "Delegate Move of Computers Between OUs").
The default is that added permissions are applied to "This object only". To
change this so that it is inherited downwards through the OU hierarchy, you
need to change this to "This object and all child objects", or to child
objects of a particular type.
To do this,
1. on the Security tab of the OU's Properties, click Advanced
2. select the permissions you want inherited downward; click Edit
3. change the setting in the "Apply onto: drop down list box to "This object
and all child objects", or the child object type of your choice
----------------------------------------------------------
Remember that "move" implies "create" in the destination and "delete" in the
source.
I suggest considering creating the computer accounts in the correct OU
before joining the computer to the domain. This has two advantages:
1. you don't have to move the computer account after the join to domain
2. the computer gets the settings from all the GPOs that apply to the target
OU during the restart required to join the computers to the domain, so it
has the desired settings immediately.
--
Bruce Sanderson
http://members.shaw.ca/bsanders
It is perfectly useless to know the right answer to the wrong question.
"BillVAS" <BillVAS@discussions.microsoft.com> wrote in message
news:977D087A-8037-4187-BCBB-E1FC0D5497D0@microsoft.com...
>I created a group call dc-joincomputertodomain Ad and pupulated the
> memberlist with our servicedesk team.
>
> The service desk team is able to join computers to the domain, but they
> cannot move the computer object joined to the domain to the proper OU
> destination.
>
> So I created a new group called ServiceDesk_AD and populated the
> memberlist
> with the same users.
>
> I then delegated ServiceDesk_AD group to be able to modify COmputer
> Objects
> in the OU we want them to move computers to.
>
> But for some reason, when they join the computer to the domain, the newly
> created computer object is no inhereting the secuirty values from the
> parent.
>
> Any Ideas?