AD permissions reset

[Pete Lillington]

I'm currently troubleshooting a sick AD installation, and
am having problems with AD ACLs. The default permissions
on objects have been modified, so for instance a DC
object will have the same restrictive permissions you'd
see on the 'administrator' user. The upshot of that is
that you cannot delete a DC object until you reset the
ACL. This, by itself, does not cause me a problem as I
can easily reset ACLs.

However, what is happening is that within the hour of ACL
getting changed by me, it gets reset to the old
restrictive ACL. Having done some (a lot) of digging,
using Repl mon and other tools, it has become apparent
that whatever DC holds the PDCE FSMO role does the reset.

The question is, why? This is not standard PDCE
behaviour, as far as I am aware!

The AD environment in question is single mixed mode
domain, W2K SP2/3. GPO is sick, secedit has been run in
the past on the whole domain because of sec corruptions.
I'm toying with the idea of fragging the whole domain and
simply starting again. Any ideas would be welcome.
Thanks.

 

[diasmith [MSFT]]

Hello Pete,

Every hour, the Microsoft Windows 2000 domain controller that has the
primary domain controller (PDC) emulator operations master role verifies
the ACL on members of these administrative groups and compares it to the
ACL on the AdminSDHolder object. If it is not the same, the ACL on the
members of the administrative group is reset to match the ACL on the
AdminSholder object
(e-mail address removed)

319966 XADM: "You Do Not Have Sufficient Permissions in the Domain" Error
http://support.microsoft.com/?id=319966

Thank You.

Diana.

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Peter Lillington]

Thanks for that Diana, the problem seems to be with the
AdminSDHolder object. Though why it got changed, who
knows!

Thanks again,

Pete

 

[diasmith [MSFT]]

Hi Peter,

No problem, glad to help.

Diana.

(e-mail address removed)

This posting is provided "AS IS" with no warranties, and confers no rights.