How do I create an ActiveView to allow Assistant Administrators to move objects from one OU to anoth (NETIQKB51024)

goal
How do I create an ActiveView to allow Assistant Administrators to move objects from one OU to another, but not include the OU itself?

goal
If I grant admins the ability to move objects from OU to OU, how do I prevent them from moving OUs as well?

fact
Directory and Resource Administrator 7.x

fix

To create an ActiveView that allows Assistant Admins to move objects from one OU to another, but not include the OU itself:

1. Open the Delegation and Configuration console with an account that has Security Admin permissions.
2. Under Delegation Management, select ActiveViews.
3. Select New ActiveView.
4. Click Next at the Welcome screen.
5. Click Add and Objects that match a rule...
6. Under Directory Objects, select Domains.
7. Click any domain and select Manage Specific Objects Types in Domain...
8. Clear Organizational Units and click OK. Leaving Computers, Contacts, Groups and Users selected will allow the Admin to move any of these object types from any OU to another.
9. Click OK.
10. Click Add> Objects that match a rule...
11. Under Directory Objects, select Organizational Units.
12. Click any OU and select Manage Specific Objects Types in Domain...
13. Click Clear All and OK.
14. Click anyOU, but no objects in the OU and select Restrict Usage and Do not allow these objects to be cloned, moved, or added to groups.
15. Click OK.
16. Click Next and give the ActiveView a name.
17. Click Finish.

When you delegate the Assistant Admins, Assistant Admin Groups, or Groups to the ActiveView, ensure you also delegate the Move Object to OU authority. The ActiveView also requires View All authority for all remaining managed objects as noted in step 8 above:

• View All Computer Properties
• View All Contact Properties
• View All Group Properties
• View All User Properties 

Formerly known as NETIQKB51024