AD - Inherit from parent the permission entries

Joe · Guest

Somehow, several thousand user acounts in an AD I'm working on have this box
(Advanced Security Settings; Inherit from parent the permission entries that
apply to child objects) unchecked.

Anyone know a quick way to restore the inheritance?

Thanks,
Joe

Jorge de Almeida Pinto [M · Guest

although you are able to check that again.... about an hour later it will be
undone

Every hour, the Microsoft Windows domain controller that has the primary
domain controller (PDC) emulator operations master role verifies the ACLs on
members of these administrative groups and compares them to the ACL on the
AdminSDHolder object. If the ACL that is on the AdminSDHolder object is
different, the ACLs on the members of the administrative group are reset to
match the ACL on the AdminSDHolder object.

For more info on the ADMINSDHOLDER object see the following related KB
articles (not all may apply to your situation!)

Description and Update of the Active Directory AdminSDHolder Object
--> MS-KBQ232199 (http://support.microsoft.com/?id=232199)
AdminSDHolder Thread Affects Transitive Members of Distribution Groups
--> MS-KBQ318180 (http://support.microsoft.com/?id=318180)
Delegated permissions are not available and inheritance is automatically
disabled
--> MS-KBQ817433 (http://support.microsoft.com/?id=817433)
AdminSDHolder Object Affects Delegation of Control for Past Administrator
Accounts
--> MS-KBQ306398 (http://support.microsoft.com/?id=306398)
Security tab of the adminSDHolder object does not display all properties
--> MS-KBQ301188 (http://support.microsoft.com/?id=301188)
"You do not have sufficient permissions in the Domain" error message occurs
and Exchange Setup does not respond
--> MS-KBQ319966 (http://support.microsoft.com/?id=319966)
Certification Authority configuration to publish certificates in Active
Directory of trusted domain
--> MS-KBQ281271 (http://support.microsoft.com/?id=281271)

also see:
http://blogs.dirteam.com/blogs/jorge/archive/2005/11/16/86.aspx

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx
-----------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test before implementing!
-----------------------------------------------------------------------------

-----------------------------------------------------------------------------
"Joe" <Joe@discussions.microsoft.com> wrote in message
news:70C3CB5B-E982-4847-8F7E-34B6C439A6D4@microsoft.com...

Joe · Guest

Thanks Jorge, I'm familier with the AdminSDHolder - I suspect that is how
the accounts ended up with the inherit box cleared, I heard a story once
about how everyone got put into the domain admins group to solve some desktop
issue LOL. Anyway, now I need to put it back so that all of our new
delegated permissions will work.

Joe

"Jorge de Almeida Pinto [MVP]" wrote:

Jorge de Almeida Pinto [M · Guest