Lync 2010 Server Control Panel returns that error "Insufficient access rights to perform the operation" when attempting a move user or enable user command

When using the Lync 2010 Server Control Panel to enable or move an Active Directory, directory service domain user for use with Lync Server 2010 the following errors are returned:

Active Directory operation failed on "DC1.contoso.com". You cannot retry this operation: "Insufficient access rights to perform the operation"

The error that is described in the SYMPTOMS section of this article is caused by the combination of the following two reasons:

*The user account that is part of the Lync 2010 Server move or enable operation is a member of an Active Directory, directory service protected domain security group. Since the user account belongs to a protected domain security group it is unable to keep the RTCUniversalUserAdmins and RTCuniversalUserReadOnlyGroup Universal Security groups and their permissions as Access Control Entries (ACEs) to the protected domain security group's default Access Control List (ACL).
*The Lync 2010 Server Control Panel is not designed to delegate the permissions that are needed to complete the user account move or enable operation

Use the Lync Server Management shell to administer the following Lync 2010 Server PowerShell cmdlets to perform the user account enable of move operations:


Enable-CsUser -Identity "Bill Anderson" -RegistrarPool "pool01.contoso.com" -SipAddressType EmailAddress -SipDomain contoso.com

To view a list of examples for the usage of the Enable-CsUser Lync Server 2010 PowerShell cmdlet use the Lync Management Shell and enter the following PowerShell cmdlet: Get-Help Enable-CsUser -Examples

Move-CsUser -Identity "Bill Anderson" -Target "pool01.contoso.com"

To view a list of examples for the usage of the Move-CsUser Lync Server 2010 PowerShell cmdlet use the Lync Management Shell and enter the following PowerShell cmdlet: Get-Help Move-CsUser -Examples

Move-CsLegacyUser -Identity "Bill Anderson" -Target "pool01.contoso.com"

To view a list of examples for the usage of the Move-CsLegacyUser Lync Server 2010 PowerShell cmdlet use the Lync Management Shell and enter the following PowerShell cmdlet: Get-Help Move-LegacyCsUser -Examples

KB2466000