user security tab

[John M]

Is there a way I can check all my user objects to see if inherent rights
from parent is set on the advanced tab of the security tab?

thanks
John

 

[Jorge de Almeida Pinto [MVP]]

if you are asking because of the adminsdholder thing... you could also query
for objects (users and groups) that have admincount=1

e.g.
ADFIND -b "<DN of OU to check>" -s subtree -f
"(&(|(objectCategory=group)(&(objectCategory=person)(objectClass=user)))(adminCount=1))"
-dn

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx

 

[John M]

I don't know what the adminsdholder thing is..
some users are not getting security from the parent because the box isn't
checked for some reason, how do I see who doesn't have it checked

thanks

"Jorge de Almeida Pinto [MVP]"

 

[Jorge de Almeida Pinto [MVP]]

then that is most probably the "adminsdholder thing"

see:
http://blogs.dirteam.com/blogs/jorge/archive/2006/05/16/981.aspx

you can use the following to determine who does not have permission
inheritance enabled:
ADFIND -b "<DN of OU to check>" -s subtree -f
"(&(|(objectCategory=group)(&(objectCategory=person)(objectClass=user)))(adminCount=1))"
-dn

ADFIND can be downloaded from www.joeware.net

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx

 

[John M]

yep that seems to do the trick
thanks

"Jorge de Almeida Pinto [MVP]"

 

[John M]

is there any way I can set this?

yep that seems to do the trick
thanks

"Jorge de Almeida Pinto [MVP]"

 

[John M]

some of the users that show up using this already have the inheritance
enabled.. any idea why?

 

[Jorge de Almeida Pinto [MVP]]

set what?


--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx

 

[Jorge de Almeida Pinto [MVP]]

read the blog posts for information on the adminsdholder

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx

 

[John M]

ok I found this an verified this is happening
http://support.microsoft.com/kb/306398/en-us

is there a way I can run a script or something to enable the Allow
Inheritable Permission from Parent check box ? Or better yet is there a fix
to stop this from happening?


"Jorge de Almeida Pinto [MVP]"

 

[Jorge Silva]

Hi John M

Strange....

Did you read the Jorge's article???
You'll find everything that you need to!!!

--
I hope that the information above helps you

Good Luck
Jorge Silva
MCSA
Systems Administrator

 

[Jorge Silva]

By the way, nice article Jorge

--
I hope that the information above helps you

Good Luck
Jorge Silva
MCSA
Systems Administrator

 

[Jorge de Almeida Pinto [MVP]]

if you read the blog posts you can find ALL the information you need. you
will also find information about a script.
READ IT!

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx

 

[John M]

sorry I didn't see the link before... I'll check it out
I have some more questions, but I'll read 1st and see if they get answered

"Jorge de Almeida Pinto [MVP]"

 

[Jorge Silva]

Yep do that...
Don't be Lazy..

--
I hope that the information above helps you

Good Luck
Jorge Silva
MCSA
Systems Administrator