AD user permission missing

Panda 5888
Panda 5888 used Ask the Experts™
on
Hi,

A few of my AD 2003 user permission on SELF keep missing even if I have set it over and over again via the AD user and computer console. The same goes to "allow inheritable permission" check box, it would go unchecked again and again ....

As u can see in the attached picture, I have actually checked the "send as",  "receive as" and "read account restriction" permission 1 hour before this, everything seems ok when I test sending and receiving emails for that user. However the permissions will go missing after 1 hour or so. The same goes to "allow inheritable permission" check box

I earlier thought it could be due to the level of administrator privilege I was using, like a lower level permission administrator cannot undo the settings done by a high level administrator. So tried using the Enterprise administrator, it didn’t help  .. the permission got reset after 1-2 hrs.

DL
self.jpg
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
How many DC are in the domain and DC which you login to make changes of the Object holds any Role .Did you check if the changes has been replicate to other DC's in the Domain.
suspect that the changed happend onthis DC is not replicating to other DC, create a test user and check if it get replicated to other DC's in the Domain.
Try checking for replication errors using repadmin /showreps /v
also try checking if the server is in usn rollback state
under path HKLM\System\CurrentControlSet\Services\NTDS\Parameters

and look for either of these entries
#define DSA_WRITABLE_GEN 1
#define DSA_WRITABLE_NO_SPACE 2
#define DSA_WRITABLE_USNROLLBCK 4
#define DSA_WRITABLE_CORRUPT_UTDV 8

If it is then follow kb
http://support.microsoft.com/kb/2023007
Distinguished Expert 2018
Commented:
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Its only for the highly privileged accounts and that too for tools like people update
More importantly in your case, if its happening with every user then its probably a usnroll back or a replication issue
Sandesh DubeyTechnical Lead
Top Expert 2011
Commented:
AdminSDHolder - or where did my permissions go?
http://msmvps.com/blogs/ulfbsimonweidner/archive/2005/05/29/49659.aspx

Delegated permissions are not available and inheritance is automatically disabled
http://support.microsoft.com/kb/817433
Panda 5888Engineer

Author

Commented:
Thanks guys .. let me check and get back to you....
Panda 5888Engineer

Author

Commented:
Hi gaurav2rawat
No errors in repadmin /showreps /v
Under path HKLM\System\CurrentControlSet\Services\NTDS\Parameters, there were no #define DSA_WRITABLE_* entries
Panda 5888Engineer

Author

Commented:
Hi Venurajav, I only have 2 DC, they are replicating ... new user is replicated to another DC
Panda 5888Engineer

Author

Commented:
Hi gaurav2rawat ... it is not happening to all users, only a like 20/1000 users are having this problem..
Engineer
Commented:
Your suggestions lead me to "members of a protected group" direction ... then I found this http://support.microsoft.com/kb/907434 which is exactly describe my situation, after a little more investigation I found that all those involved are members of the Printer Operator, which is a protected group ... I've removed one of the user from Printer Operator, I will wait for 1-2 hrs before reseting his account with the correct permission, and then wait another 1-2 hrs to see if those permisson stays...
Panda 5888Engineer

Author

Commented:
when I remove the user from Printer operator group ... their permission stays, but once I put them back to Printer operator group, their permission goes missing again.

The missing permissions are "Send As right from the user and Allow inheritable permissions from parent to propagate to this object check box no longer selected."
Distinguished Expert 2018

Commented:
Yes. That's expected behavior as you could read in the articles me and others have linked. The MS article you linked offers a best practice and a workaround. Any questions left?
Panda 5888Engineer

Author

Commented:
working solution

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial