Hello,

I'm running into a problem. I have a user who's not inheriting
permissions form the parent and he's supposed to be. Under the Security
tab I click the Advanced button and check the "Inherit from parent the
permissions..." and then click the Default button to replace the
permission entries with the default settings. This sets the permissions
properly. However, after about a half hour the permissions have
reverted back to their previous state.

How can I prevent this from happening?

Thanks,

George

Take a look at this, which may explain the cause of you problem:
http://support.microsoft.com/kb/817433/en-us

KR,
Marc

George,

The permissions are changing because of the AdminSDHolder object. Is this
user by chance a part of following:

Domain Administrators
Enterprise Administrators
Schema Administrators
Administrators
Account Operators
Server Operators
Print Operators
Backup Operators
(and others)

Hi Sara,

Funny you mentioned the BES issue. That's how I stumbled across this!
:) I changed the AdminSDHolder object to inherit permissions and that
seemed to work.

Thanks!

George

Saral6978 wrote:

are you aware of what you have done?

the adminsdholder objects protects groups and members of protected groups.
by allowing such thing you enabled, you just may have given other admin to
make changes to those powerfull accounts

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
----------------------------------------------------------------...

It was a recommendation per the Microsoft KB

Jorge de Almeida Pinto [MVP - DS] wrote:

which KB?

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
----------------------------------------------------------------...

ok, but do you unuderstand the impact?

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
----------------------------------------------------------------...