Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I took over a network where it appears that domain users were added to the domain admins group at some point in the past. This caused every account to block security inheritance in Active Directory. Is there an easy way to force inheritance on all user account objects again?

share|improve this question
are you sure its not an adminsdholder problem? – tony roth Jul 8 '10 at 22:01
here is a link… – tony roth Jul 8 '10 at 22:03
I'm pretty sure that's what the problem is (or was). Domain users were added to domain admins group which caused the adminsdholder thread to disable inheritance on every account. Now that the users are no longer part of the domain admin group, I need to re-eneable inheritance. – Jason Berg Jul 8 '10 at 22:05
Oh wait...I see what's going on...even if I enable inheritance it's still going to disble it...grrrr..easy fix anyone? – Jason Berg Jul 8 '10 at 22:07
so you've made sure they are not members of the other protected groups right? – tony roth Jul 8 '10 at 22:16
up vote 1 down vote accepted

read carefully!

share|improve this answer
That worked so perfectly. Thank you. – Jason Berg Jul 9 '10 at 4:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.