So I have a bunch of users in AD that for some reason, don't inherit permissions from the security applied to the OU they are in. This is problematic, because account operators can't unlock, change passwords, etc., and they need to be able to do this.

I just want to force inheritance on all users, but I don't know how to do that. Any ideas?

3 Answers 3


You can enable/disable inheritance in dsa if you turn on Advanced Features under View. This will add a Security tab (among others) to object properties. On the Security tab click the Advanced button and check/uncheck Include inheritable permissions from this object's parent.

enter image description here

Alternatively, you can use the command line to enable inheritance. The dsacls command allows you to modify domain ACLs. The following would enable inheritance for my user object:

dsacls "CN=Jason Scott,OU=Staff,OU=ISC,OU=Buildings & Depts,DC=my,DC=domain,DC=edu" /P:Y

Should you require setting inheritance for a large number of user objects, wrap the above in a FOR loop which calls dsquery. A very brute-force example would be something like:

FOR /F "usebackq delims=;" %A IN (`dsquery user -limit 0`) DO dsacls %A /P:Y

If these users are "un-inheriting" themselves automatically, you may be seeing a side effect of AdminSDHolder. If you remove the users from all of the AdminSDHolder protected groups, they should retain their inheritance settings.

  • This should take care of what I need... I'll test it on a few users and then run it en masse for the rest. I don't know why some users are disabled on inheritence and some aren't, as I was given the domain by the prior admin. Thanks for the help!
    – Shyatic
    Mar 28, 2011 at 14:21
  • We ran the above batch command and it turned off our ability to see the users in Exchange Manage Console. Argh!
    – user171404
    Apr 26, 2013 at 22:55

Account Operators by default should have the permissions in question on all user objects in the domain. This security is based on the Security ACL on the User objects. In the AD Users and Computers MMC go to view and select "Advanced Features". Then search for a User you suspect is not inheriting permissions and view the properties. Find the "Security" tab and hit the "advanced" button to see if the "Include inheritable permissions from this object's parent" is checked and the Account Operators group is listed in the ACL with the appropriate permissions.


what if I dont want to remove users from one of the protected groups but still force the inheritence. So my issue is that I am trying to sync a admin user account using ad connect to azure but i cant coz inheritence is not enabled for that user and it would not assign those permissions to the ad connect service account principal otherwise.

  • 1
    If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review
    – Dave M
    Dec 11, 2021 at 14:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.