AdminSDHolder Object Affects Delegation of Control for Past Administrator Accounts

A user or group (for example, helpdesk) is delegated control over an Organizational Unit (OU) by using the Delegation of Control Wizard. One or more users that are located in the OU are made members of the administrators group or a group the user is a member of is made a member of the administrators group. After the user or group is moved out of the administrators group, the helpdesk is unable to manage the user or group of users that were once administrators.

Once a user is added to an administrators group, the "Allow Inheritable Permissions From Parent" security setting is cleared on the user object. When the user is moved out of the administrators group, the "Allow Inheritable Permission from Parent" setting is not automatically added back.

If there are users that currently have the delegation-management problem:

1. Start Active Directory Users and Computers, and then find the appropriate user object.
2. Right-click the object, click Properties, and then click the Security tab.
3. Click to select the Allow Inheritable Permission from Parent check box, click Apply, and then click OK.You can now manage the user account.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

For additional information about why the inheritance permission is disabled on administrative accounts, click the article number below to view the article in the Microsoft Knowledge Base: