[f21]

Sounds like you delegated account operator control to this team? The Account Operator group does not grant Read permissions on the built-in OU, so you need to fix your permissions.

Use the delegation control wizard again and create a custom task for the OU. Add Object Type control for computer objects + create/delete objects in this folder. Under permissions set Read/write account restrictions, reset password, validate write to DNS host name, and validate write to service principal name.

Should fix your access denied issue.

[guyt]

Originally Posted by f21

Sounds like you delegated account operator control to this team? The Account Operator group does not grant Read permissions on the built-in OU, so you need to fix your permissions.

Any authenticated user has read access to almost all of the objects in domain partition (including the built-in Computers and Users containers)