I am a member of domain admins, but I have been denied access to a certain OU.

[Shane M Ryan]

I am a member of domain admins, but I have been denied access to a certain
OU. I think I can fix this with dsacls.exe. How does this syntax look? Do
I need to run the /R first so that my denied permissions are removed?



dsacls ou=parentOU,ou=childOU,dc=customerdomain,dc=com /G
"customerdomain\myaccount":RC

 

[Frank Szita [MSFT]]

I would recommend using adsiedit to change the permissions. It's a GUI
interface that will allow you to apply permissions as you would on an NTFS
file or folder. You can view active directory objects which will allow you
to view the properties. There you can set permissions. It's easier than
using a command line utility. Adsiedit is installed with the Support Tools
which comes with the operating system's installation CD.

Best regards,

Frank Szita [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.