RE: "Send As" permission resetting on SBS

Hi Tom,

I understand that your issue is that the 'Send As' permission granted for
user A to 'send as' user B keeps disappearing.If I am off base, please
don't hesitate to let me know.

Let us refer to the following steps to troubleshoot the issue:

1.you need to move the user account from the following group since the
permission of the user account that is a member of one of administrative
groups will be reset to match the ACL of the AdminSDHolder thread.

Enterprise Admins
Schema Admins
Domain Admins
Administrators
Domain Controllers
Cert Publishers
Backup Operators
Replicator Server Operators
Account Operators
Print Operators

2.In addtion,install SBS 2003 SP1

Note:This issue could be caused by the groups listed above since the these
groups are one of the protected groups in Windows 2003 server. An Active
Directory domain controller that holds the primary domain controller (PDC)
operations master role (also known as the flexible single master operations
role or the FSMO role) runs a thread every hour to check the access control
lists (ACLs) on the above groups and all of the member objects of these
groups.


If a user account is a member of one of these administrative groups because
of its membership with a distribution group, the user account's ACL is
checked when the thread is run and may be reset to match the ACL of the
AdminSDHolder thread.


For more information:

"You do not have sufficient permissions in the Domain" error message occurs
and Exchange Setup does not respond
http://support.microsoft.com/?id=319966

AdminSDHolder Thread Affects Transitive Members of Distribution Groups
http://support.microsoft.com/?id=318180

I appreciate your time. I am happy to be of assistance and look forward to
your reply.

Best regards,

Jacky Luo (MSFT)
Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
====================================================
PLEASE NOTE: The partner managed newsgroups are provided to
assist with break/fix issues and simple how to questions.
We also love to hear your product feedback! Let us know what you think by
posting

from the web interface: Partner Feedback
from your newsreader: microsoft.private.directaccess.partnerfeedback.

We look forward to hearing from you!
====================================================
When responding to posts, please "Reply to Group" via your newsreader
so that others may learn and benefit from this issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
====================================================

.

Relevant Pages

  • RE: "Send As" permission resetting on SBS
    ... permission of the user account that is a member of one of administrative ... groups will be reset to match the ACL of the AdminSDHolder thread. ... Directory domain controller that holds the primary domain controller ...
    (microsoft.public.windows.server.sbs)
  • Re: How to use a Group Distribution list inorder to send and received messages
    ... In the Permissions list, locate Send As, and then click to select the ... permission of the user account that is a member of one of administrative ... groups will be reset to match the ACL of the AdminSDHolder thread. ... Directory domain controller that holds the primary domain controller ...
    (microsoft.public.exchange.admin)
  • Re: How to use a Group Distribution list inorder to send and received messages
    ... In the Permissions list, locate Send As, and then click to select the ... permission of the user account that is a member of one of administrative ... groups will be reset to match the ACL of the AdminSDHolder thread. ... Directory domain controller that holds the primary domain controller ...
    (microsoft.public.exchange.admin)
  • Re: Validate user permission
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... authenticated user can modify a given attribute (member is the one you ... there is an advanced permission called "Write ...
    (microsoft.public.dotnet.security)
  • Re: Validate user permission
    ... Thanks a lot for the reply Joe! ... authenticated user can modify a given attribute (member is the one you are ... which is the only attribute in the Write Members permission ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.dotnet.security)