theft recovery domain group
I had the issue in Theft Recovery where I couldn't return the device to the main domain OU. I had to move them to a sub-domain and move them again.
It doesn't make sense to me for this not to be the first option! All of my devies are in the main domain OU and the users are placed in sub-domain OUs.