While doing some testing, I have accidentally revoked Read permission for "Authenticated users" on a user in AD, and now I can not grant it again, because user is "invisible".
I've done the following:
- Open MMC / Active directory users and computers
- Switch to advanced view (View/Advanced features)
- Right click the user
- Select Security tab
- Click on "Authenticated users" group
- Select "Read" permission (none of the check boxes were checked)
- Check the "Deny" checkbox, and confirm the dialogs
The user was shown as "Unknown" for a while in MMC, and now it completelly disappered. So I can not right click him to restore permission :-)
I have tried serveral tools to restore the access, but was unable to do it.
Some sources indicates, that
dsacls.exe can be used to print out ACLS and restore them to AD schemas defaults. However, it looks like that even dsacl can not access the object.
AdFind.exe does not find him too.
The user is not deleted, so Sysinternal's
adrestore.exe is of no use, too.
The user is currently logged int, but he is unable to send and receive emails- It disappeard in Exchange too.
I thought that I will still be able to enumerate the user (I haven't revoked List children permission).
Can I reset the permission on parent OU? I am afraid, that this wuold apply the same permission to all users in this OU (Which I do not want).
I am using Windows 2003 R2 domain.