Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

win2k3. Logged in as the domain admin account, I cannot modify a specific user. I can edit other users. Almost every change I try gives "access denied". This users is a former domain admin who is no longer with the company and I need to disable their account.

share|improve this question

3 Answers 3

up vote 4 down vote accepted
  • Open the properties for the user account
  • Object tab
  • Untick "Protect from accidental deletion" option
  • Security Tab
  • Advanced button
  • Make sure the "Inherit from parent" option is ticked
  • Owner tab
  • Other Users and Groups button
  • Type in Domain Admins and click OK
  • Click OK
  • Click OK
share|improve this answer
    
Inherit from parent worked, thanks –  bugtussle Sep 20 '10 at 14:51
1  
You forgot to mention the tool you're using. The "AD Users & Computers" tool doesn't have an object tab... and the "adsi edit" tool doesn't have a "Protect from accidental deletion" option that I can find. –  TheCompWiz Sep 20 '10 at 14:55
3  
Erm, ADUC does have an object tab, and it does have a protect from accidental deletion option under that tab. You need to enable Advanced features in ADUC. –  Izzy Sep 20 '10 at 14:56
    
Thanks Izzy... never bothered to look for the "Advanced Features" :D –  TheCompWiz Sep 20 '10 at 16:36

It sounds like this user modified the ACL's on the user account so that it could not be modified. Try setting permissions inheritance on the object and see if that then lets you modify it.

share|improve this answer

... Is your domain admin account "Administrator" (built-in administrator... not add-on)

Unfortunately, there's several ways a "super-user" could be created in a windows environment... to-which you can't effect changes... without having access to that account. I would look at the permissions & ownership on the object in AD (use adsiedit.msc) & see if you can modify them... or at least identify what/who has permissions over that user...

It sounds like your former employee has left himself a back-door. If that's the case... and the employee didn't leave of his own desire... you might need to call the law-enforcement folks... and at the very least... file a report. This will make things easier to pursue if you can't gain access to that account... and/or you find bad things happening to your network.

share|improve this answer
3  
-1 Erm... I don't think anything of the sort has happened, and I most certainly don't think the police need to be involved. It was quite simply a permissions/ACL issue. –  Izzy Sep 20 '10 at 14:55
1  
... someone had to effect those permissions... and all I was suggesting is that if the employee left on bad terms the admin should be careful that there might be other "back-doors" or future problems... A police report is not an unreasonable precaution. It would save him headaches in the future if legal action is warranted. –  TheCompWiz Sep 20 '10 at 15:03
1  
Do you realise how silly, and frivolous it would have been for him to contact the police, when all that was wrong was the permissions on the account had been changed, quite possibly for very sound reasons? We change the default permissions on all our Domain Admin accounts to prevent accidental editing and/or deletion. All I'm saying is that sounding the sirens and declaring DefCon 2 should not be the first reaction to any strange things you find in your environment. –  Izzy Sep 20 '10 at 15:08
    
Do you know how many police reports are filed every day? You can file a police report that the sun was too bright on a Thursday if you feel so inclined. No legal action will EVER be taken simply because there is a report filed someplace. But when things turn for the worst... having that one report filed can make the difference between a 2-month battle... and a 10-year battle. The KEY to this whole discussion was on the reason the employee is no longer part of the company. I didn't suggest you call the cops to go arrest someone... or take any legal action. –  TheCompWiz Sep 20 '10 at 15:14
1  
Also if you guys cant quit your bickering, i am going to turn this post around and go back home –  bugtussle Sep 20 '10 at 15:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.