I came across an interesting error today when attempting to move a security group to a new location in Active Directory.
Windows cannot move object because Access is denied
Windows cannot move object because Access is denied
This issue was caused by "Protect object from accidental deletion"
By default this feature is only enabled on organisational units however in this environment, some groups and user objects had this feature enabled as well. I believe this was manually enabled by a sysadmin in the past.