Announcement

Collapse
No announcement yet.

Remove User from AdminSDHolder

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Remove User from AdminSDHolder

    Sup,

    We have several users (100's) that were in an administrator group way back when we were on NT4. After the upgrade to 2003, these accounts will not inherit security from the parent.

    I have found the adminCount =1 and set it to 0. I enable inheritance and wait.

    When SDProp runs it changes the adminCount back to 1 and removes the permissions.

    The only thing I can find is Domain/Domain Users are in the Print Operators group. (no idea who or why did that). Technically that is a protected group, but most of our users are not affected by this. Only the people who were here at the time of the upgrade.

    Is there any way I can completely remove the user from be protected by AdminSDHolder??

    The current "fix" is delete the account and recreate it.

  • #2
    Re: Remove User from AdminSDHolder

    Hi,

    Have a look at this: http://support.microsoft.com/?id=817433
    Also: http://technet.microsoft.com/en-us/l.../cc772662.aspx
    Caesar's cipher - 3

    ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

    SFX JNRS FC U6 MNGR

    Comment


    • #3
      Re: Remove User from AdminSDHolder (Fixed)

      Thanks.

      After two days of reading, I have it fixed.

      1. We recently rebuilt the print server, so I made sure no one needed Print Operators permissions (It was from a long time ago when the migrated the domain). I removed Domain Users from Print Operators.

      2. This allowed Inherited Permissions to be checked on Domain Users group.
      3. After that I used ADmodify and removed the adminCount=1 from their AD profile and set security inheritance on the users.

      And it worked. All security settings now stick. Just have a 23 page list of AD accounts to go through.

      Thanks again.

      Comment

      Working...
      X