If you have a Kerberized cluster configured with an Active Directory KDC, you can use the following steps to move the Kerberos principals from one AD Ogranizational Unit (OU) to another.

1. Create the new OU on the Active Directory Server.
2. Use AD's Delegate Control wizard to set the permissions on the new OU such that the configured Cloudera Manager admin account has the ability to Create, Delete and Manage User Accounts within this OU.
3. Stop the cluster.
4. Stop the Cloudera Management Service.
5. In Active Directory, move all the Cloudera Manager and CDH components' user accounts to the new OU.
6. Go to Cloudera Manager and go to Administration > Security.
7. Go to the Kerberos Credentials tab and click Configuration.
8. Select Scope > Settings.
9. Select Category > Kerberos.
10. Locate the Active Directory Suffix property and edit the value to reflect the new OU name.
11. Click Save Changes to commit the changes.