inherit security rights on users objects in administrative groups

[James Smith]

We have a situation where all user objects, which are
members of either Domain Admins, or Administrators, have
the Inherit check box cleared. No matter how many times
we go in and check this box, it clears automatically. We
can create a new user and watch the account for days and
the box will be checked, untill we add them to an
administrative group, then it clears.

This is an issue for us since we're a pretty big
Sharepoint shop, some of the code our developers have
added pulls user information and it's being blocked from
reading attributes on these users.

Any help would be appreciated.

Thanks

 

[Joe Richards [MVP]]

This is by design. Search google for adminSDHolder object information.

 

[Jimmy Andersson [MVP]]

It's called adminSDHolder, Administrator security descriptor holder.
It's a protection of administrative groups by a background task that
computes the set of memberships and checks whether their security
descriptors are well-known protected security descriptors.

Regards,
/Jimmy