Granular permissions to move Computer Objects out of Computers Container in Active Directory

To configure granular permissions to move computer objects out of Computers container in Active Directory follow the steps:

1. Use ADSIEdit/open "Default naming context".
2. Navigate to Computers container/Security/Advanced.
3. Desired group along with obvious permissions ("Delete Computer Objects" for "This object only", "List contents", "List object" and "Read all properties" for "This object only") needs to have "Allow" permission for "Write all properties" for "Descendant Computer objects".