I took over a network where it appears that domain users were added to the domain admins group at some point in the past. This caused every account to block security inheritance in Active Directory. Is there an easy way to force inheritance on all user account objects again?

  • are you sure its not an adminsdholder problem? – tony roth Jul 8 '10 at 22:01
  • here is a link blogs.technet.com/b/askds/archive/2009/05/07/… – tony roth Jul 8 '10 at 22:03
  • I'm pretty sure that's what the problem is (or was). Domain users were added to domain admins group which caused the adminsdholder thread to disable inheritance on every account. Now that the users are no longer part of the domain admin group, I need to re-eneable inheritance. – Jason Berg Jul 8 '10 at 22:05
  • Oh wait...I see what's going on...even if I enable inheritance it's still going to disble it...grrrr..easy fix anyone? – Jason Berg Jul 8 '10 at 22:07
  • so you've made sure they are not members of the other protected groups right? – tony roth Jul 8 '10 at 22:16

read carefully!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.