Active Directory: ERROR_DS_MODIFYDN_WRONG_GRANDPARENT (0X00002186)

What triggers this error

You're in Active Directory Users and Computers (ADUC) or using PowerShell. You right-click a user or group, hit Move, and pick a new OU. The move fails with error 0X00002186 and message: This object is not allowed to change its grandparent container. I've seen this mostly when admins try to reorganize a messy AD structure—moving a user from OU=Sales,DC=contoso,DC=com directly into OU=Managers,OU=Employees,DC=contoso,DC=com.

The real cause? AD won't let you change the grandparent of a DN in one move. The grandparent is the object two levels above the target. If the new parent OU sits under a different parent than the original, the move is blocked.

Fix 1: Move step by step through the OU tree

This is the most common fix. You need to move the object to an intermediate OU first, then to the final destination.

1. Open Active Directory Users and Computers. Go to View and check Advanced Features—this shows you the full OU tree.
2. Locate the object you're trying to move. Right-click it, select Move.
3. Pick an OU that's a direct sibling of the target's grandparent. For example, if the target is OU=Managers,OU=Employees,DC=contoso,DC=com, move the object to OU=Employees,DC=contoso,DC=com first.
4. Click OK. The move should succeed. Check the event log—you'll see a success event for directory service changes.
5. Now right-click the object again, choose Move, and this time pick the final OU. Since the grandparent stayed the same (OU=Employees), the move goes through.

If you're using PowerShell, the fix is similar. Use Move-ADObject twice:

Move-ADObject -Identity "CN=JohnDoe,OU=Sales,DC=contoso,DC=com" -TargetPath "OU=Employees,DC=contoso,DC=com"
Move-ADObject -Identity "CN=JohnDoe,OU=Employees,DC=contoso,DC=com" -TargetPath "OU=Managers,OU=Employees,DC=contoso,DC=com"

After the second command, verify with Get-ADUser JohnDoe. The DistinguishedName should show the new path.

Fix 2: Create the destination OU under the same grandparent

Sometimes the OU structure itself is the problem. Say you want to move an object from OU=Sales,DC=contoso,DC=com to OU=Temp,OU=Projects,DC=contoso,DC=com. The grandparent of OU=Temp is OU=Projects, but the original grandparent is DC=contoso,DC=com. They're different, so the move fails.

The brute-force fix is to restructure the OUs so the destination grandparent matches the source grandparent:

1. Open ADSI Edit. Connect to the domain partition.
2. Navigate to the Domain node, then find the OU where you want the final destination. Right-click and choose New > Object. Create an OU called Temp under that same parent.
3. Now the target path is OU=Temp,DC=contoso,DC=com—same grandparent (DC=contoso,DC=com) as the source.
4. Move the object directly to OU=Temp. It works because the grandparent hasn't changed.

I don't recommend this if you already have a well-organized OU tree. It's a band-aid for a poorly planned hierarchy. Better to fix the move order instead.

Fix 3: Use ADSI Edit to manually update the distinguishedName (advanced)

Only do this if you're comfortable editing the directory directly. One wrong click can break your domain. I've used this trick when the object is orphaned or when PowerShell keeps failing.

1. Open ADSI Edit. Connect to the domain partition.
2. Find the object. Right-click it and select Properties.
3. Double-click the distinguishedName attribute. Change it to the full DN of the target location. Example: change CN=JohnDoe,OU=Sales,DC=contoso,DC=com to CN=JohnDoe,OU=Managers,OU=Employees,DC=contoso,DC=com.
4. Click OK. Then update the parentGUID attribute to match the new parent. To find the GUID of the target parent OU, run: Get-ADOrganizationalUnit -Identity "OU=Managers,OU=Employees,DC=contoso,DC=com" | fl ObjectGUID
5. Copy that GUID into the parentGUID field. Click OK twice to close.

After this, run repadmin /syncall to force replication. Check with Get-ADUser JohnDoe—the DN should match what you set. If you see error 0x2013, you missed the parentGUID update.

Quick-reference summary table

One last thing: always test moves in a lab first. I've seen admins panic when they break the OU hierarchy on a Friday afternoon. Don't be that guy.