Fix 0X00002185: Active Directory rename blocked by flag

Quick answer for pros: Use ADSI Edit to remove the nTSecurityDescriptor flag ACL_PROTECTED from the object's DACL, then retry the rename or move. See steps below.

Why does this happen?

You're getting error 0X00002185 (the friendly name is ERROR_DS_MODIFYDN_DISALLOWED_BY_FLAG) when you try to rename or move an object in Active Directory. This normally hits domain admins who are moving a user or computer between OUs or renaming a group. The system says "no" because that object has a special flag that says "don't let anyone change my name or location."

The flag is a security descriptor control called SE_DACL_PROTECTED (or ACL_PROTECTED). It's often set by backup software, migration tools, or a script that accidently locked the object. Once that flag is on, Active Directory won't let you rename or move the object — even if you're a domain admin.

Fix: Remove the protected flag with ADSI Edit

This is the real fix. Don't mess with recreating the object or exporting/importing — that's overkill and risky. Just turn off the flag.

Open ADSI Edit. Run adsiedit.msc from an elevated command prompt (Run as Administrator).
In the left pane, right-click ADSI Edit and choose Connect to.... Leave it as Default naming context (that's your domain). Click OK.
Expand the domain tree. Navigate to the folder that contains your object. For example, if it's a user in OU=Employees,DC=contoso,DC=com, drill down to that OU.
Right-click the object (user, computer, group) that shows the error. Pick Properties.
In the Attribute Editor tab, scroll down to nTSecurityDescriptor. That's the security descriptor. Double-click it.
In the window that opens, look at the DACL Control Flags section. If Protected is checked, that's the culprit.
Uncheck the Protected box. Do not change anything else. Click OK on that window.
Click OK on the Properties window. The flag is cleared.
Now go back to your original task (rename or move). It should work. Test it.

After step 8 you should see: The object's properties close normally. No error. When you retry the rename or move, it completes without the 0X00002185 error.

Alternative fix: Use PowerShell to clear the flag

If you prefer a script or ADSI Edit isn't available, use the Active Directory module.

Get-ADUser -Identity "jdoe" -Properties nTSecurityDescriptor | ForEach-Object {
  $sd = $_.nTSecurityDescriptor
  $sd.SetAccessRuleProtection($false, $true)
  Set-ADUser -Identity "jdoe" -Replace @{nTSecurityDescriptor=$sd}
}

Replace jdoe with the actual samAccountName. For a computer, use Get-ADComputer. For a group, Get-ADGroup. This does the same thing — removes the protected flag.

If the fix doesn't work: Check inheritance

Sometimes the flag reappears right after you clear it. That means a parent OU has a protected ACL that propagates down. In that case:

Check the parent OU's nTSecurityDescriptor — uncheck Protected there too.
Or apply a GPO that forces the ACL to be unprotected. But honestly, that's rare. Usually the flag is on the object itself.
If you still get the error, check if the object is in a protected group (e.g., Domain Admins, Enterprise Admins). Some built-in security groups can't be renamed by design. In that case you can't fix it — Microsoft blocks it on purpose. But for normal user/computer objects, this fix works.

How to prevent this from happening again

The flag gets set when someone (or something) explicitly changes permissions on that object and checks "Prevent inheritance" in the Security tab. Here's how to avoid it in the future:

Don't use "Prevent inheritance" on AD objects unless you really need to. Use special permissions instead.
When you migrate objects with tools like ADMT or Quest, check their settings — some have a default to protect the ACL. Turn that off.
After a backup restore, scan objects for the protected flag. A quick PowerShell script can list all objects with it. That way you catch it early.

That's it. One flag, one uncheck, and you're done. No need to rebuild the object from scratch.