Link to home
Start Free TrialLog in
Avatar of netdatatech
netdatatech

asked on

User keeps loosing BESAdmin Sendas rights

I have a domain set up with three DCs, two running Server 2003 SP2 and one running Server 2000 SP4. I have BES 4.1.4 running on a virtual Server 2000 "server", and have 15 Blackberry users. Until a few days ago, everything was working correctly. Then one user told me they could not send messages from their blackberry. Upon investigation, I found that BESAdmin (with Sendas rights) keeps dissapearing from the "Security" tab in his account properties. He's not a membar of any privileged groups (Enterprise Admins, Domain admins, Administrators), nor are any of the groups he's a member of, and nothing has been changed in AD that I'm aware of from the time that it worked to when it quit working. Also, the "Allow Inheritable Permissions from the parent..." check box is not checked. I'm pretty sure it's not a BES issue, but an AD issue since BES doesn't change permissions, it just goes by what's there. The only time I've seen behavior like this is when the user is a member of a privileged group, which is not the case. All other Blackberry users are working properly, and the BESAdmin "Sendas" rights remain intack on them all (except this one user). Has anyone seen something like this before and have any suggestions on how to fix it?

Thanks.
ASKER CERTIFIED SOLUTION
Avatar of swaller
swaller
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of netdatatech
netdatatech

ASKER

Thanks for the input Swaller. You pointed me in the right direction. After searching for AdminSDHolder info, I discoverd that "Printer operators" is among the protected groups (I had added him to the printer operators so he could administor the printers as needed). I have removed him from that group and will create a new group for that purpose.
Warning, once a user is in the protected groups then removing them from the admin group will not fix the problem. The "Protected group" flag remains afterward.