OU delegated rights stop working

[JimS]

W2K sp4 native domain..

Delegated "Add a computer account" permission to a global
group of users. All was well for months. Recently,
various members of that group lost the ability to add
computer accounts. Granted permission again to
individual user, and now they can add computer accounts
again. They are still members of the group. Have not
done any domain upgrades recently - only added new OUs,
and other objects.

Anyone ahve any ideas why these dlelegated permissions
stop working?

Jim

 

[Tim Springston [MSFT]]

Hi Jim-

Delegations are changes to permissions on a containers in AD. This suggests
that the permissions on the container that the delegation was done to had
changed at some point.

An alternative exmplanation, if the domain is Windows 2000 SP4 or Windows
Server 2003, is that the users were at one time in the intervening period,
members of a protected group-however nested that relationship may have been.
Here's some additional information on that:

817433 Delegated Permissions Are Not Available and Inheritance Is
Automatically
http://kb/article.asp?id=Q817433