Mdthbs

How to deal with employer who keeps me at work after working hours

Dirichlet series with a single zero

As a GM, is it bad form to ask for a moment to think when improvising?

Simple Derivative Proof?

As black, how should one respond to 4. Qe2 by white in the Russian Game, Damiano Variation?

Is there precedent or are there procedures for a US president refusing to concede to an electoral defeat?

Gerrymandering Puzzle - Rig the Election

How to remap repeating commands i.e. <number><command>?

Does running exec do anything?

In "Avengers: Endgame", what does this name refer to?

Would a small hole in a Faraday cage drastically reduce its effectiveness at blocking interference?

Which US defense organization would respond to an invasion like this?

Why does blending blueberries, milk, banana and vanilla extract cause the mixture to have a yogurty consistency?

How can a hefty sand storm happen in a thin atmosphere like Martian?

Why didn't this character get a funeral at the end of Avengers: Endgame?

Hostile Divisor Numbers

When did England stop being a Papal fief?

How can Internet speed be 10 times slower without a router than when using the same connection with a router?

Krull dimension of the ring of global sections

Where are the "shires" in the UK?

Has the United States ever had a non-Christian President?

Counting the Number of Real Roots of A Polynomial

Is there an age requirement to play in Adventurers League?

How to pass hash as password to ssh server

Can't delete OU from AD, IsCriticalSystemObject attribute TRUE - cannot change

Cannot delete orphaned domain contorllerActive Directory - User cannot change passwordCannot delete Active Directory userHow to delete domain user profile from a computer?Can't delete Active Directory objectClients can't update dNSHostName attribute after DNS suffix changeCannot RDP from Ubuntu to WS 2016 with Domain UserCan ping DC from client, cannot join domainCannot delete Recovery snapshots Windows Server 2016Cannot change domain password after Forest Functional Level Upgrade

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}

3

I recently took over a contract for a customer where the previous IT apparently did a half-ass job of migrating from SBS Server to Server 2016.

In AD there's an OU called MyBusiness which has two subfolders: SBSComputers and SBSUsers. I've moved all of the computers out of SBSComputers to the top level Computers OU and the same for SBSUsers. The folders are empty.

Now I'm trying to delete the two OU's but they have the isCriticalSystemObject attribute set as TRUE. When I try to set the attribute to FALSE I get the following error:

Operation failed. Error code: 0x2077

Illegal modify operation. Some aspect of the modification is not permitted.

00002077: SvcErr: DSID-03190CD8, problem 5003 (WILL_NOT_PERFORM), data 0

Thanks for any help guys, pulling my hair out with this one!

active-directory windows-server-2016

share|improve this question

asked 12 hours ago

brentaarnoldbrentaarnold

184

New contributor

brentaarnold is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  "I recently took over a contract for a customer where the previous IT apparently did a half-ass job of migrating from SBS Server to Server 2016" - bad-mouthing begets bad-mouthing. There's value and no honor in doing it.
  
  – joeqwerty
  12 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Oh, they definitely did a half-ass job but it wasn't for this issue. There was ghost DC's, dual DHCP's and all kinds of bad DNS records. Definitely was a half-ass job.
  
  – brentaarnold
  11 hours ago
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  You may have inherited a mess, but I don't see the point in bad-mouthing your predecessor. Clean it up, leave it better than you found it, and take pride in a job well done. There's no point in knocking other people.
  
  – joeqwerty
  11 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Will take your advice as food for thought, Joe.
  
  – brentaarnold
  11 hours ago
  

  
  
  
  

add a comment | 

3

I recently took over a contract for a customer where the previous IT apparently did a half-ass job of migrating from SBS Server to Server 2016.

In AD there's an OU called MyBusiness which has two subfolders: SBSComputers and SBSUsers. I've moved all of the computers out of SBSComputers to the top level Computers OU and the same for SBSUsers. The folders are empty.

Now I'm trying to delete the two OU's but they have the isCriticalSystemObject attribute set as TRUE. When I try to set the attribute to FALSE I get the following error:

Operation failed. Error code: 0x2077

Illegal modify operation. Some aspect of the modification is not permitted.

00002077: SvcErr: DSID-03190CD8, problem 5003 (WILL_NOT_PERFORM), data 0

Thanks for any help guys, pulling my hair out with this one!

active-directory windows-server-2016

share|improve this question

asked 12 hours ago

brentaarnoldbrentaarnold

184

New contributor

brentaarnold is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  "I recently took over a contract for a customer where the previous IT apparently did a half-ass job of migrating from SBS Server to Server 2016" - bad-mouthing begets bad-mouthing. There's value and no honor in doing it.
  
  – joeqwerty
  12 hours ago
  
  
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Oh, they definitely did a half-ass job but it wasn't for this issue. There was ghost DC's, dual DHCP's and all kinds of bad DNS records. Definitely was a half-ass job.
  
  – brentaarnold
  11 hours ago
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  You may have inherited a mess, but I don't see the point in bad-mouthing your predecessor. Clean it up, leave it better than you found it, and take pride in a job well done. There's no point in knocking other people.
  
  – joeqwerty
  11 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Will take your advice as food for thought, Joe.
  
  – brentaarnold
  11 hours ago
  

  
  
  
  

add a comment | 

I recently took over a contract for a customer where the previous IT apparently did a half-ass job of migrating from SBS Server to Server 2016.

In AD there's an OU called MyBusiness which has two subfolders: SBSComputers and SBSUsers. I've moved all of the computers out of SBSComputers to the top level Computers OU and the same for SBSUsers. The folders are empty.

Now I'm trying to delete the two OU's but they have the isCriticalSystemObject attribute set as TRUE. When I try to set the attribute to FALSE I get the following error:

Operation failed. Error code: 0x2077

Illegal modify operation. Some aspect of the modification is not permitted.

00002077: SvcErr: DSID-03190CD8, problem 5003 (WILL_NOT_PERFORM), data 0

Thanks for any help guys, pulling my hair out with this one!

active-directory windows-server-2016

share|improve this question

asked 12 hours ago

brentaarnoldbrentaarnold

184

New contributor

brentaarnold is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

asked 12 hours ago

brentaarnoldbrentaarnold

184

New contributor

brentaarnold is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

asked 12 hours ago

brentaarnoldbrentaarnold

184

New contributor

brentaarnold is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 12 hours ago

brentaarnoldbrentaarnold

184

New contributor

brentaarnold is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 12 hours ago

brentaarnoldbrentaarnold

184

2 Answers
2

active

oldest

votes

2

Now I'm trying to delete the two OU's but they have the
isCriticalSystemObject attribute set as TRUE.

This is because those are the default locations for new computer and user objects in an SBS domain. The fact that you've removed SBS doesn't change the fact that this was set automatically by the SBS install when the domain was created. If you want to delete those OU's then you'll need to change the default location for new computer and user objects.

http://www.expta.com/2009/03/changing-default-users-and-computers.html

share|improve this answer

edited 11 hours ago

answered 12 hours ago

joeqwertyjoeqwerty

96.9k465149

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  This fix worked perfectly. Thanks so much Joe!
  
  – brentaarnold
  11 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Glad to help...
  
  – joeqwerty
  11 hours ago
  

  
  
  
  

add a comment | 

2

You have to (re)set the default location for new user/computer objects aded to the domani to another container/ou.

Set the OU/CN fpr new computers

C:> redircmp OU=NewComputerOU,DC=domain,dc=tld

Set the OU/CN fpr new users

C:> redirusr OU=NeueBenutzerOU,DC=domain,dc=tld

After that change was replicated, the old OUs can be deleted.

share|improve this answer

answered 7 hours ago

bjosterbjoster

1,9351919

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

brentaarnold is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f965875%2fcant-delete-ou-from-ad-iscriticalsystemobject-attribute-true-cannot-change%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

2

Now I'm trying to delete the two OU's but they have the
isCriticalSystemObject attribute set as TRUE.

This is because those are the default locations for new computer and user objects in an SBS domain. The fact that you've removed SBS doesn't change the fact that this was set automatically by the SBS install when the domain was created. If you want to delete those OU's then you'll need to change the default location for new computer and user objects.

http://www.expta.com/2009/03/changing-default-users-and-computers.html

share|improve this answer

edited 11 hours ago

answered 12 hours ago

joeqwertyjoeqwerty

96.9k465149

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  This fix worked perfectly. Thanks so much Joe!
  
  – brentaarnold
  11 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Glad to help...
  
  – joeqwerty
  11 hours ago
  

  
  
  
  

add a comment | 

2

Now I'm trying to delete the two OU's but they have the
isCriticalSystemObject attribute set as TRUE.

This is because those are the default locations for new computer and user objects in an SBS domain. The fact that you've removed SBS doesn't change the fact that this was set automatically by the SBS install when the domain was created. If you want to delete those OU's then you'll need to change the default location for new computer and user objects.

http://www.expta.com/2009/03/changing-default-users-and-computers.html

share|improve this answer

edited 11 hours ago

answered 12 hours ago

joeqwertyjoeqwerty

96.9k465149

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  This fix worked perfectly. Thanks so much Joe!
  
  – brentaarnold
  11 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Glad to help...
  
  – joeqwerty
  11 hours ago
  

  
  
  
  

add a comment | 

Now I'm trying to delete the two OU's but they have the
isCriticalSystemObject attribute set as TRUE.

This is because those are the default locations for new computer and user objects in an SBS domain. The fact that you've removed SBS doesn't change the fact that this was set automatically by the SBS install when the domain was created. If you want to delete those OU's then you'll need to change the default location for new computer and user objects.

http://www.expta.com/2009/03/changing-default-users-and-computers.html

share|improve this answer

edited 11 hours ago

answered 12 hours ago

joeqwertyjoeqwerty

96.9k465149

share|improve this answer

edited 11 hours ago

answered 12 hours ago

joeqwertyjoeqwerty

96.9k465149

answered 12 hours ago

joeqwertyjoeqwerty

96.9k465149

answered 12 hours ago

joeqwertyjoeqwerty

96.9k465149

2

You have to (re)set the default location for new user/computer objects aded to the domani to another container/ou.

Set the OU/CN fpr new computers

C:> redircmp OU=NewComputerOU,DC=domain,dc=tld

Set the OU/CN fpr new users

C:> redirusr OU=NeueBenutzerOU,DC=domain,dc=tld

After that change was replicated, the old OUs can be deleted.

share|improve this answer

answered 7 hours ago

bjosterbjoster

1,9351919

add a comment | 

2

You have to (re)set the default location for new user/computer objects aded to the domani to another container/ou.

Set the OU/CN fpr new computers

C:> redircmp OU=NewComputerOU,DC=domain,dc=tld

Set the OU/CN fpr new users

C:> redirusr OU=NeueBenutzerOU,DC=domain,dc=tld

After that change was replicated, the old OUs can be deleted.

share|improve this answer

answered 7 hours ago

bjosterbjoster

1,9351919

add a comment | 

You have to (re)set the default location for new user/computer objects aded to the domani to another container/ou.

Set the OU/CN fpr new computers

C:> redircmp OU=NewComputerOU,DC=domain,dc=tld

Set the OU/CN fpr new users

C:> redirusr OU=NeueBenutzerOU,DC=domain,dc=tld

After that change was replicated, the old OUs can be deleted.

share|improve this answer

answered 7 hours ago

bjosterbjoster

1,9351919

C:> redircmp OU=NewComputerOU,DC=domain,dc=tld

C:> redirusr OU=NeueBenutzerOU,DC=domain,dc=tld

share|improve this answer

answered 7 hours ago

bjosterbjoster

1,9351919

answered 7 hours ago

bjosterbjoster

1,9351919

answered 7 hours ago

bjosterbjoster

1,9351919