Cause for permission denied on windows active directory

Question

General problem: By trying to change something in AD, e.g. in the ADUC, I get with a specific user a permission denied (with delegated permissions).

Is there a way to determine, what permission exacly caused the permission denied - like a deny rule that applies. (like lsass -v :)

Answer 1

Your question isn't exactly clear, but I think what you're looking for is the Effective Permissions tab. You can inspect properties of the object that you're trying to modify. Click on Security. Click on Advanced. Click on Effective Permissions and then select the user that you want to see the permissions for. It will calculate the effective permissions for the selected user on the object that you're looking at.