>I'd start looking around for the AD Delegation WhitePaper, as that was one of the tools that came with that bad boy. >It's either out, or very close I've held my breath in anticipation of this paper as long as I can, I think 'soon' is overdue, even in MS time :-[
Does one of you insider's have an update on it's availability? ________________________________ From: Kingslan, Rick T. [mailto:[EMAIL PROTECTED] Sent: Thursday, November 13, 2003 10:25 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] New Tool... DSREVOKE. Interesting - I'd start looking around for the AD Delegation WhitePaper, as that was one of the tools that came with that bad boy. It's either out, or very close. Rick Kingslan MCSE, MCSA, MCT Microsoft MVP - Active Directory LAN Administration - Windows 2000 West Corporation [EMAIL PROTECTED] ________________________________ From: Myrick, Todd (NIH/CIT) [mailto:[EMAIL PROTECTED] Sent: Thursday, November 13, 2003 9:26 AM To: '[EMAIL PROTECTED]' Subject: [ActiveDir] New Tool... DSREVOKE. Dsrevoke is a command-line tool that can be used on domain controllers that are running Windows Server 2003 or Windows 2000 Server to report the existence of all permissions for a specific user or group on a set of OUs in a domain and optionally remove from the DACLs of a set of OUs all permissions specified for a particular user or group. Dsrevoke complements the functionality provided by the Delegation of Control Wizard, which is used to delegate administrative authority, by providing the ability to revoke delegated administrative authority. http://www.microsoft.com/downloads/details.aspx?FamilyID=77744807-c403-4 bda-b0e4-c2093b8d6383&DisplayLang=en -----Original Message----- From: Creamer, Mark [mailto:[EMAIL PROTECTED] Sent: Thursday, November 13, 2003 10:18 AM To: [EMAIL PROTECTED] Subject: [ActiveDir] OT: Using subinacl on a registry key Can't find anything on this and wondered if anyone has a solution. I'm using subinacl to change permissions on a registry key in a script. The problem is that by default the key has Inherit Permissions checked, which seems to negate the change. Is there a way I can 1. programmatically uncheck inherit 2. copy the existing permissions 3. add my new permission setting using subinacl Thanks, Mark Creamer Systems Engineer Cintas Corporation http://www.cintas.com Honesty and Integrity in Everything We Do List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
