hawthornedirect
asked on
can I revert permissions for "self" account in Active Directory?
I was trying to change the permissions so that users could edit all the settings in galmod32 and used the Delegate Control wizard to add permissions. After "adding" these permissions, now the users can't even change the attributes they were able to before. I also think that I applied the changes to the entire directory, not just a particular OU. Is there a way to make the permissions for "self" go back to what they were by default?
ASKER
I definitely learned my lesson not to apply the untried to the entire domain.
I'm not familiar with the dsacls command. I will look on my own, but can you tell me the syntax to revert the permissions for "self" back to what they were? I'm also puzzled as to why granting permissions didn't seem to work, but for right now I'd be happy to have back what we had.
I'm not familiar with the dsacls command. I will look on my own, but can you tell me the syntax to revert the permissions for "self" back to what they were? I'm also puzzled as to why granting permissions didn't seem to work, but for right now I'd be happy to have back what we had.
ASKER
If I go to Properties for the domain and select the Security tab, I can look at the security setting for "Self" in there. In Advanced there is an option to replace the permission entries with the default settings. Would this take us back to where we were?
ASKER CERTIFIED SOLUTION
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
ASKER
I ran the command against an OU to test it and it seemed to correct everything just fine. I ran it against the rest of the domain next. It appeared to work alright, but I got two unsettling messages "Cannot remove the folder" and "The command completed unsuccessfully." On the other hand everything seemed to be back to normal when I tested it with galmod32.
There seemed to be a momentary glitch later on when I couldn't connect to the Exchange server and Activesync for Exchange on my phone quit working, but then in a few minutes it was working again.
Thoughts?
There seemed to be a momentary glitch later on when I couldn't connect to the Exchange server and Activesync for Exchange on my phone quit working, but then in a few minutes it was working again.
Thoughts?
ASKER
I have a backup of the domain controller from last night, so I've saved it in two different places just in case this blows up in my face. Thanks so much for your help.
dsacls DC=Domain,DC=Com /S /T..
Try do it with objects rathwer than doing it on complete domain
like dsacls ou=*****, DC=Domain,DC=Com /S /T..
Please refer this link too
http://www.enterprisenetworkingplanet.com/netos/article.php/623801/Active-Directory-Modifying-Default-Permissions.htm