Re: Distribution Groups changing to Security Groups

From: Joe Richards [MVP] (humorexpress_at_hotmail.com)
Date: 01/12/05


Date: Wed, 12 Jan 2005 12:57:54 -0500

I saw and responded to your other post, but I wanted to respond to this as well.
It is is possible for ACLs to be set on a group that directly disallows an Admin
from changing a group type or whatever else. You always need to look at the
actual ACL on the object now, being an Admin doesn't mean you automatically get
to change anything you want in AD.

However being an admin, if you want to change something in AD, even if you don't
have permission, there are ways to grant yourself those permissions to do so.

  joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net
Stephane Gagne wrote:
> which permission do I need since I'm logged as administrator ???
> 
> "Joe Richards [MVP]" wrote:
> 
> 
>>That means you don't have permission. The GUI should be able to do it if you 
>>have permissions.
>>
>>If you have Windows 2003 you can use dsmod. However, if you don't have 
>>permissions, it won't do it either.
>>
>>   joe
>>
>>--
>>Joe Richards Microsoft MVP Windows Server Directory Services
>>www.joeware.net
>>
>>
>>Stephane Gagne wrote:
>>
>>>Sorry ..
>>>
>>>
>>>I can't change this option in Active Directory Users and Computers, the 
>>>security type is shaded.  I know that tehre is some command line to manage 
>>>AD, do you know by which one I can change this parameter ?
>>>
>>>"Joe Richards [MVP]" wrote:
>>>
>>>
>>>
>>>>Sure, just change the grouptype attribute of the group. That can be done through 
>>>>the aduc or via scripts.
>>>>
>>>>
>>>>--
>>>>Joe Richards Microsoft MVP Windows Server Directory Services
>>>>www.joeware.net
>>>>
>>>>
>>>>Stephane Gagne wrote:
>>>>
>>>>
>>>>>Hi,
>>>>>
>>>>>Is there a way to change all distribution groups to security groups whiout 
>>>>>deleting the distribution group and create a new security group ?
>>>>>
>>>>>I've tried to assign permisions on a public folder for a distribution group 
>>>>>but I have an error: The modified permissions could not be saved.  The client 
>>>>>operation failed...
>>>>>
>>>>>Thanks
>>>>>
>>>>>"Joe Richards [MVP]" wrote:
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>>Anytime *ANYONE* uses a DL to assign permissions to anything in Exchange 
>>>>>>(including say a user giving a DL permissions on a calendar or something), 
>>>>>>Exchange converts the DL to a Security enabled DL.
>>>>>>
>>>>>> joe
>>>>>>
>>>>>>--
>>>>>>Joe Richards Microsoft MVP Windows Server Directory Services
>>>>>>www.joeware.net
>>>>>>
>>>>>>
>>>>>>John Marszalek wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>>I have a question:
>>>>>>>
>>>>>>>We have a couple of Distribution groups in our W2K3 AD that are set up so a 
>>>>>>>user can e-mail a group of people, and every now and then, when we go back 
>>>>>>>into AD, they are changed to security groups.  Why is it changing them?  
>>>>>>>There are only 3 people who have access to our AD, and no one is changing 
>>>>>>>them.  This has happened a few times.  Any ideas?  I can be e-mailed at 
>>>>>>>jmarsz@educ.state.wy.us.  Thanks!
>>>>>>


Relevant Pages

  • Re: How can I report a bug to Microsoft Windows 2000 Team?
    ... Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.win2000.active_directory)
  • Re: Applied security groups
    ... but the core design is such that everything is a collection of loosely connection parts to help allow for decent scaling. ... Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.windows.server.active_directory)
  • Re: Distribution Groups changing to Security Groups
    ... Try to reapply the permission now that you have changed your domain mode. ... > security group with the same members, the last group will have the given ... >>Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.exchange2000.active.directory.integration)
  • Re: Overlap subnets in AD sites and Services
    ... Joe Richards Microsoft MVP Windows Server Directory Services ... to simplify AD Sites and Services configuration, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Making the active directory redundant
    ... www.AtTheDataCenter.com (personal website) ... Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.windows.server.active_directory)