In our Active Directory (2008 R2), I used delegation to give permission to edit user information attributes such as phone numbers, title, postal address, ... to a group of non-admin users.

Members of this group can now edit most users information, but they can't edit the info of administrators. But why? I didn't find any "Deny" clauses that could be causing that.

1 Answer 1


Probably the SDAdminHolder feature. It blocks permission inheritance for accounts that are members of the protected groups. You could confirm this by inspecting the permission on the accounts, and the permission of the account parent container.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.