Inheritance on user objects with Domain Admin membership

R

Rob

Hi,

I have come accross an interesting problem that I can not
determine is a security feature of Windows 2000 AD or is a
problem with the tool we use for Active Directory
Administrative delegation (Quest Active Roles).

The issue is this: Our administrative accounts are
sequestered into a specific container with permissions to
the container objects applied at the root of the container
itself. All objects are set to allow inheritance of
permissions. We began noticing a handful of the user
objects did not have inheritance set and our level 1 help
desk could not reset the passwords. After reseting
inheritance on the user objects it reverts back to no
inheritance within an hour or so. I have determined that
any user object that has membership in Domain Admins or
Administrators will exhibit this issue. If an account
(user object) is removed from membership in those groups
inheritance will stay.

Can anyone tell me if this is a security feature of Win2k
to prevent accidentally allowing rights to inherit on high
level administrative accounts? Or is this caused by
something else?

Thanks,
Rob
(e-mail address removed)
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Inheritance is automatically disabled on some user accounts approximately one ti 5
Prevent some Domain Admin Account from creating USERS, Groups, OUs 2
inheretance is broken - sdprop adminsdholder, builtin container an 0
Security changes for User Object do not stick 1
Problem with creating Foreign Security Principals Objects 0
Location of User Account in Active Directory - OU or top level? 1
Security and groups disappears after 60 mins on objects. 1
How to Remove Ghost DC from AD 3

Top