RE: [ActiveDir] some users do not have allow "inheritable permissions" set

[David Cliffe]

Hi Ben,       Putting aside AdminSDHolder for a moment....maybe you were looking for the  /P:N  option instead?  Of course this may increase the number of ACEs on the object more than what you'd like, but I saw the  /I:T  thing and thought that's more applicable to the parent object, rather than the leaf object.  Hopefully I understood correctly...   -DaveC From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steve Linehan Sent: Thursday, November 10, 2005 1:19 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] some users do not have allow "inheritable permissions" set Just out of curiosity when you go back an hour later is the box unchecked?  This really sounds like the work of AdminSDHolder and the users in question are likely members of protected groups.  If you have not looked at the following Knowledge Base article you may want to see if this is what you are running into: http://support.microsoft.com/default.aspx?scid=kb;en-us;817433.   Thanks,   -Steve From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ben D. Kusa Sent: Wednesday, November 09, 2005 7:17 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] some users do not have allow "inheritable permissions" set some users do not have allow "inheritable permissions" set. The only way I have found to reset that setting is to open each user and check that option off.   I have tried running dsacls OU=ou,DC=dc,DC=dc /I:T and it seems to go through ok but does not reset that option. Should that work? Or does anyone know any other way to set that option on multiple users   Thanks Ben     To find out more about Reuters visit www.about.reuters.com Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Reuters Ltd.