Re: Account Operators Group

Does this article explain what you see:

http://support.microsoft.com/kb/245174

Per the article Account Operators cannot manage users that are members of
the following restricted groups:

Account Operators
Administrators
Backup Operators
Print Operators
Server Operators
Domain Admins

If you have users that are not members of any of these groups, even due to
group nesting, and lack the ACE, then you have a problem. However, any
program to fix it must check each user for membership in any of these
groups, or any other groups that are members of these groups.

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--


.

Relevant Pages

  • Re: adminDSholder being over zealous!
    ... I have experienced the same problems, where users in members of groups ... without the account ACLs reverting to match AdminSDHolder. ... account operators can manage their own accounts or the ... >>A supported fix is now available from Microsoft, ...
    (microsoft.public.win2000.security)
  • Re: Account Operators Group
    ... Per the article Account Operators cannot manage users that are members of ... Server Operators ... If you have users that are not members of any of these groups, ... delegation of control wizard ...
    (microsoft.public.win2000.active_directory)
  • Account operators
    ... Designated users are members of account operators but ...
    (microsoft.public.win2000.active_directory)