I'm trying to grant ForceChangePW privilege to a non-administrator user, as stated here:

enter image description here

So in the delegation of control wizard I've checked the following tasks

enter image description here

Then on another computer I logged in as that user, when I try to modify the password of a Domain Admin user, e.g net user XXX newpassword /domain

I still get Access Denied error

enter image description here

Any ideas?

| improve this question | | | | |

Members of protected groups, such as Domain Admins, have the security permissions (ACL) reset every hour. Even if you delegate permissions to another security principal, it will not apply to protected users.

AdminSDHolder, Protected Groups and SDPROP

| improve this answer | | | | |
  • Yep, this is the answer. – MDMarra Nov 12 '17 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.