Re: Security groups being removed

Hello,

Thank you for your update.

As far as I know, we can set forest-wide dsHeuristic flags to control which
operator groups are protected by adminSDHolder. By using this new option,
you can set some or all the enlisted four protected groups not to be
protected by adminSDHolder.

Account Operators
Server Operators
Print Operators
Backup Operators

I understand that you would like to turn off the protect group feature as a
whole. However, as you know, forest wide groups, such as Domain Admins,
have great influence on the domain security. We cannot turn off the
adminSDHolder for all protected groups.

For more information about adminSDHolder, you may refer to:

817433 Delegated permissions are not available and inheritance is
automatically disabled
http://support.microsoft.com/kb/817433

Hope it helps. If you have any questions or concerns, please do not
hesitate to let me know.



Best regards,
Miles Li

Microsoft Online Partner Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

.