Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

I need to delegate permissions to edit user information (phone numbers, address, etc) in AD. Its a 2003 domain. Ive already delegated: 'Read all user information' and 'Read, Write, Read and write general information, Read and write phone and mail options, read and write public information, read and write personal information.

So far none of these have helped the specific user edit details. Its been logged off and back on already too.

What am i missing?

share|improve this question
Try using the ACL editor directly, instead of the delegation wizard. Check for Deny ACEs against any groups that user might be in? – Shane Madden Jul 26 '11 at 0:05
i found no Deny entries at all – Devnull Jul 26 '11 at 12:33
it looks like this is now not working only for specific users, still not sure why but its good for the majority of the objects. – Devnull Jul 27 '11 at 0:10

1 Answer

up vote 2 down vote accepted

Oh, that sounds like AdminSDHolder protection. Check if inheritance is disabled for the users' ACLs, and/or check the value of the adminCount property on the objects. This occurs for users that are in (or sometimes, were once in) one of the protected administrative groups. See here.

share|improve this answer
i cant check right now but knowing the list of people that couldnt be edited, im almost 100% certain you are correct. – Devnull Jul 28 '11 at 0:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.