not saving security settings

[serverguy]

In AD U&C, going into a user's properties, security tab. If I add the
builtin group, Account Operators and give them full control and click OK,
when I refresh, the group is gone. Any ideas?

This is a 2003 functional level single domain and forest with user accounts
migrated from NT4 domain last year. All has worked very smoothly, but for a
small bunch of users, not all users, I cannot seem to apply this simple
change. I am a domain and enterprise admin.

The basic goal here is to give the helpdesk staff the ability to unlock
accounts for ALL users. They are in the Account Operators group. They have
this ability for most users except this small bunch of IT and operations
staff, so I'm simply trying to fix it so I don't get anymore phone calls on
the weekend to unlock user accounts.

Any suggestions appreciated.
Jerry

 

[Chriss3]

Hello Jerry,
I recommend you to use the Delegate of Control wizard instead. If you modify
the ACL (Security) for a member of one or more protected group, your changes
will be replaced by the security template.

Protected Groups are:
Administrators
Account Operators
Server Operators
Print Operators
Backup Operators
Domain Admins
Schema Admins
Enterprise Admins
Cert Publishers

 

[serverguy]

Thanks for the quick response. That explains the behavior. I may need to
create more OU's in order to use the Delegate control b/c I didn't want to
change all users just a few. Thanks again.

 

[Chriss3]

Delegate of Control wizard actually do the same thing, it modify the ACL
(Security) for you. But that is a better why than add account administrators
to the Account Operators Group.