Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Domain running on Windows 2003, in 2000 mode. I'm trying to create an AD group to grant temporary Domain Admin permissions to user, to save having to give them permanent DA.

I've created an AD group: g.Temp_DomainAdmin, in an OU: Groups/Admin/Delegated Permissions.

I've got a scheduled task running a VBScript to remove all users from this group.

The task runs as a service account, with limited permissions: s.purge_temp_da

I've delegated permissions on the OU to the service account to allow full control over groups under it.

Running the task manually works perfectly. But whenever it comes to run at midnight, it fails with "-2147024891 - General access denied error". Looking at the g.Temp_DomainAdmin group shows that the delegated permissions have disappeared.

Any ideas? Here's the VBScript:

Option Explicit
Dim objRootDSE, strDomain, objGroup, objUser, strdistinguishedName, arrDnComponents
Const ADS_PROPERTY_DELETE = 4
' Retrieve domain information
Set objRootDSE = GetObject("LDAP://RootDSE")
strDomain = objRootDSE.Get("DefaultNamingContext")
' Bind to the group
Set objGroup = GetObject("LDAP://CN=G.ADM.Temp_DomainAdmin,OU=Delegated Permissions,OU=Admin,OU=Resource Access,OU=groups," & strDomain)

' Iterate through the user objects in the group
For Each objUser In objGroup.Members

    on error resume next

    ' Get the users distinguishedName
    strdistinguishedName = objUser.distinguishedName
    wscript.echo "Removing " & objUser.cn

    ' Remove the user from the group
    objGroup.PutEx ADS_PROPERTY_DELETE, "member", Array(strdistinguishedName)
    objGroup.SetInfo
    wscript.echo "Removed " & objUser.cn

    if err.number <> 0 then
        wscript.echo err.number & " - " & err.description
    end if

    on error goto 0
Next
wscript.echo "Done"

Thanks

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

You're experiencing the effects of the "adminSDHolder" and "SDProp" functionality of Active Directory. The purpose of this functionality is to apply a known ACL to security principals (users, groups, and computers) that are members of special protected groups. Your "g.Temp_DomainAdmin" group, by being a member of "Domain Admins", has been marked with an "adminCount" value of "1" and is now subject to the "adminSDHolder". The ACL on your "g.Temp_DomainAdmin" group will be reset to a known ACL when this thread runs. (Microsoft has a more long-winded description of this functionality if you care to know more details.)

You can modify the adminSDHolder ACL to allow for what you're trying to do, but it's generally not a recommended practice.

Since your script has the power to add/remove members of the "Domain Admins" group you're probably best off just running that script as a user with "Domain Admins" membership, thereby circumventing the need to delegate any permissions for the script. (Basically, if somebody "owns" the script execution context, even with the delegation you've tried to arrange, they can just use the script to add themselves to "Domain Admins" anyway. The delegation complicates matters and offers no real security.)

share|improve this answer
    
Excellent description. I have wondered about this for years but never bothered to track down the root cause. –  Tim Brigham Nov 11 '12 at 1:55
    
Many thanks Evan. I was trying to avoid having an account with DA run this, but your explanation makes sense. We've got far too many service accounts with DA, and I was trying to avoid adding another. –  pixelseventy2 Nov 12 '12 at 10:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.