i've created an OU higharcy and delegated access to a group with full control over all objects and descendant objects. Why cant a member of the group with delegated access rename a domain joined computer in the OU? i've verified the group is local admin on the server and even created a second delegation for the write all properties of descendant computer objects in the OU. I can see in the security setting on the server object all of the settings are as expected. there are no deny's in any of the settings on the OU. Could there be a GPO i'm not thinking of that is restricting this?
i've gone through multiple pages on technet looking for answer that isnt local admin / write all properties on the computer object.
thanks,
jason