So I have a bunch of users in AD that for some reason, don't inherit permissions from the security applied to the OU they are in. This is problematic, because account operators can't unlock, change passwords, etc, and they need to be able to do this.

I just want to force inheritance on all users, but I don't know how to do that. Any ideas?

Thanks for the help!


You can enable/disable inheritance in dsa if you turn on Advanced Features under View. This will add a Security tab (among others) to object properties. On the Security tab click the Advanced button and check/uncheck Include inheritable permissions from this object's parent.

enter image description here

Alternatively, you can use the command line to enable inheritance. The dsacls command allows you to modify domain ACLs. The following would enable inheritance for my user object:

dsacls "CN=Jason Scott,OU=Staff,OU=ISC,OU=Buildings & Depts,DC=my,DC=domain,DC=edu" /P:Y

Should you require setting inheritance for a large number of user objects, wrap the above in a FOR loop which calls dsquery. A very brute-force example would be something like:

FOR /F "usebackq delims=;" %A IN (`dsquery user -limit 0`) DO dsacls %A /P:Y

If these users are "un-inheriting" themselves automatically, you may be seeing a side effect of AdminSDHolder. If you remove the users from all of the AdminSDHolder protected groups, they should retain their inheritance settings.

  • This should take care of what I need... I'll test it on a few users and then run it en masse for the rest. I don't know why some users are disabled on inheritence and some aren't, as I was given the domain by the prior admin. Thanks for the help! – Shyatic Mar 28 '11 at 14:21
  • We ran the above batch command and it turned off our ability to see the users in Exchange Manage Console. Argh! – user171404 Apr 26 '13 at 22:55

Account Operators by default should have the permissions in question on all user objects in the domain. This security is based on the Security ACL on the User objects. In the AD Users and Computers MMC go to view and select "Advanced Features". Then search for a User you suspect is not inheriting permissions and view the properties. Find the "Security" tab and hit the "advanced" button to see if the "Include inheritable permissions from this object's parent" is checked and the Account Operators group is listed in the ACL with the appropriate permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.