Re: AD Delegation Fails - Permissions Disappear

see:
http://blogs.dirteam.com/blogs/jorge/archive/2006/05/16/981.aspx

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
"rovert506" <rovert506@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:38835BBE-4107-43E8-AED4-8BDC38B5C370@xxxxxxxxxxxxxxxx
Windows Server 2003 Standard:

I'm trying to delegate control of some OU's to three groups. Each of
these
groups will have specific permissions (unlock accounts, reset password,
create/manage/delete). I've tried multiple times to delegate the control,
but it never works. We recently upgraded from NT about 8 months ago, and
what I've found is that all the Pre-NT accounts were not set up to inherit
permissions from parent objects. Every account since the switchover is
set
up correctly, and works as it should when I test the delegations.

I manually went into each old user account and selected the "inherit
permissions from parent" checkbox (there are about 200 accounts). About
halfway through the users, I checked on the first account I changed and
saw
that the permissions were reverted back. Thus the "inherit parent object
permissions" was UNSELECTED, when I know that I did in fact select it. I
do
not know why this is happening...

Any ideas??


.

Relevant Pages

  • Re: "Allow inheritable permissions from parent to propagate to this object" gets unchecked on Domain
    ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... Always test ANY suggestion in a test environment before implementing! ... permissions from parent to propagate to this object" on several domain ADMIN accounts grouped in the same OU on windows 2003 server in native mode. ...
    (microsoft.public.windows.server.active_directory)
  • Re: File Sharing (again - sorry, Pd)
    ... InTerminal, type umask. ... Back in the good old days, Mac OS X user accounts ... The reason that the file permissions are "resetting" each time the ... that folder inherit the ACLs from the folder. ...
    (uk.comp.sys.mac)
  • Re: Security Group Keeps getting removed???
    ... ACL on all security principals (users, groups, and machine accounts) present ... Delegated permissions are not available and inheritance is automatically ... AdminSDHolder Object Affects Delegation of Control for Past Administrator ...
    (microsoft.public.windows.server.active_directory)
  • Re: Delegating AD Rights (Enable/Disable Accounts)
    ... I will definitely pass it on to my Customer ... user accounts in AD to non-admin staff so that they will be able to ... permissions as Domain User rights will work just fine. ... The UMRA ...
    (microsoft.public.windows.server.scripting)
  • Re: Delegation - Password Reset - Access Denied
    ... If you go to properties of an AD object, select the security tab and click ... on advanced you should be on the permissions tab. ... WARNING - Any implicit permissions defined will be lost and reset back to ... Accounts in the OU and found that the BldgAdmins group was not listed. ...
    (microsoft.public.windows.server.active_directory)