Hi Tony,
late response as well - sorry.
I guess why this isn't cleaned up is the same thing as in many other issues.
If you have an admin which is in certain operators groups, and he's
loosing those groups, it's likely that he has been delegated in some other
ways. So not reversing the settings
@mail.activedir.org
Subject: RE: [ActiveDir] AdminSDHolder orphans
Hi Tony,
late response as well - sorry.
I guess why this isn't cleaned up is the same thing as in many other issues.
If you have an admin which is in certain operators groups, and he's
loosing those groups, it's likely that he has been
Of Tony Murray
Sent: Montag, 22. Januar 2007 01:00
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AdminSDHolder orphans
Hi Ulf
Thanks for the thoughts.
I can see there could be issues with trying to revert settings after an
object is removed from one of the protected groups. I'm now
Sorry, Tony. I've been away from emails for most of the week. Did you get a
useful response to your question? If not, does my 2-part AdminSDHolder blog
(http://www.akomolafe.com/JustSaying/tabid/193/EntryID/19/Default.aspx and
/2006 6:06 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AdminSDHolder orphans
Sorry, Tony. I've been away from emails for most of the week. Did you get a
useful response to your question? If not, does my 2-part AdminSDHolder blog
(http://www.akomolafe.com/JustSaying/tabid/193
Message -
From: Brian Desmond [EMAIL PROTECTED]
To: ActiveDir@mail.activedir.org
Sent: Tuesday, December 19, 2006 2:38 AM
Subject: RE: [ActiveDir] AdminSDHolder orphans
Yeah this caused me issues when I was at a large client which had this
proposensity to put everyone and their brother
PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Paul Williams
Sent: Tuesday, December 19, 2006 1:29 AM
To: ActiveDir@mail.activedir.org
Subject: Re: [ActiveDir] AdminSDHolder orphans
The SDPROP thread technically, doesn't do anythign with inheritance.
That
is a trait of the security descriptor
]
[mailto:[EMAIL PROTECTED] On Behalf Of Paul Williams
Sent: Tuesday, December 19, 2006 1:29 AM
To: ActiveDir@mail.activedir.org
Subject: Re: [ActiveDir] AdminSDHolder orphans
The SDPROP thread technically, doesn't do anythign with inheritance.
That
is a trait of the security descriptor, which
Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Paul Williams
Sent: Tuesday, December 19, 2006 1:29 AM
To: ActiveDir@mail.activedir.org
Subject: Re: [ActiveDir] AdminSDHolder orphans
The SDPROP thread technically, doesn't do anythign with inheritance.
That
is a trait
Yeah this caused me issues when I was at a large client which had this
proposensity to put everyone and their brother into a group that
triggered this behavior. What I would do is dump everyone with
admincount0, then set admincount=0 on all of them, wait a bit, and see
who was back to 0 and then
?
My first thought would be YES, it should reverse the changes it made
previously...on the other side...why doesn't it already? there is a
script...2003 is the second AD version... so I suspect something else might be
the reason why it does not do it
adminSDHolder sets the list you mention
11 matches
Mail list logo
