Delegated permissions are not available and inheritance is automatically disabled

After you upgrade to Microsoft Windows Server 2003, you may experience the following symptoms:

• Delegated permissions are not available to all users in an organizational unit.
• Inheritance is automatically disabled on some user accounts approximately one time an hour
• Users who previously had delegated permissions, no longer have them.

This problem may also occur after you apply the hotfix described in Microsoft Knowledge Base article 327825 to Microsoft Windows 2000 Server or after you install Windows 2000 Service Pack 4 to Microsoft Windows 2000 Server. For more information about the Windows 2000 327825 hotfix, click the following article number to view the article in the Microsoft Knowledge Base:

When you delegate permissions using the Delegation of Control wizard, these permissions rely on the user object that inherits the permissions from the parent container. Members of protected groups do not inherit permissions from the parent container. Therefore, if you set permissions using the Delegation of Control wizard, these permissions are not applied to members of protected groups.

Note Membership in a protected group is defined as either direct membership or transitive membership using one or more security or distribution groups. Distribution groups are included because they can be converted to security groups.

In Windows Server 2003, the number of groups that are protected has been increased to enhance security in Active Directory (see the "More Information" section). The number of groups that are protected also increases if you apply the 327825 hotfix to Windows 2000.

To resolve this problem, you can install a hotfix. You must install the hotfix on the domain controller that holds the primary domain controller (PDC) emulator operations master role in each domain. Additionally, you must install the hotfix on all domain controllers that you might use to take over this role if the current PDC emulator operations master role holder becomes unavailable. If you are not sure of the domain controller you would use to take over the role, we recommend that you consider installing the hotfix on all domain controllers. If a domain controller without the hotfix assumes the PDC emulator operations master role, the user's permissions will be reset again.

Windows 2000 hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2003 service pack information

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Windows Server 2003 hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language. The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

Windows Server 2003, 32-bit editions

Windows Server 2003, 64-bit editions

After you install the hotfix in Windows 2000 and in Windows Server 2003, you can set forest-wide dsHeuristic flags to control which operator groups are protected by adminSDHolder. By using this new option, you can set some or all the enlisted four protected groups back to the original Windows 2000 behavior. Character position 16 is interpreted as a hexadecimal value, where the left-most character is position 1. Therefore, the only valid values are "0" through "f". Each operator group has a specific bit as follows:

• Bit 0 : Account Operators
• Bit 1 : Server Operators
• Bit 2 : Print Operators
• Bit 3 : Backup Operators

For example, a value of 0001 means exclude Account Operators. A value of 'c' would exclude Print Operators (0100) and Backup Operators (1000) because the binary sum 1100 reflects a hexadecimal value of 0xC.

To enable the new functionality, you must modify an object in the configuration container. This setting is forest wide. To modify the object, follow these steps:

1. Locate the object that you want to modify. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:
   326690

   (http://support.microsoft.com/kb/326690/ )

   Anonymous LDAP operations to Active Directory are disabled on Windows Server 2003 domain controllers
2. At a command prompt, type ldp.exe and then press ENTER to start the LDP utility.
3. Click Connection, click connect and then click OK.
4. Click Connection, click Bind, type the user name and password of a forest root administrator, and then click OK.
5. Click View, click Tree, and then click OK.
6. Using View\Tree, open the following configuration CN:
   CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=Forest root domain
7. Locate the Directory Service object, and then double-click it.
8. Check the object attribute listing on the right side to determine whether the dsHeuristics attribute is already set. If it is set, copy the existing value to the clipboard.
9. Right-click the Directory Service objects on the left side, and then click Modify.
10. As the attribute name, type dsHeuristics.
11. As a value, type 000000000100000f. Replace the zeros in the first part of the value with what you may already have in dsHeuristics. Make sure that you have the correct count of digits up to the "f" or whatever bits you want to set.
    
    Note To verify that the correct characters are being modified, every tenth character must be set to the number of characters up to that point divided by ten. For example, the tenth character must be 1, the twentieth character must be 2, the thirtieth character must be 3, and so on.
12. If the attribute already existed, click Replace in the Operation box. Otherwise, click Add.
13. Press ENTER on the right to the Operation group to add it to the LDAP transaction.
14. Click Run to apply the change to the object. After this change is replicated to the PDC emulators in the forest, the ones that are running this hotfix will not protect the users who are members of the operators group that you have set the bits for.

To work around this problem, use one of the following methods.

Method 1: Make sure members are not members of a protected group

If you use permissions that are delegated at the organizational unit level, make sure that all users who require the delegated permissions are not members of one of the protected groups. For users who were previously members of a protected group, the inheritance flag is not automatically reset when the user is removed from a protected group. To do this, you can use the following script.

Note This script checks the inheritance flag for all users whose AdminCount is set to 1. If inheritance is disabled (SE_DACL_PROTECTED is set), the script will enable inheritance. If inheritance is already enabled, inheritance will remain enabled. Additionally, AdminCount will be reset to 0. When the adminSDHolder thread runs again, it will disable inheritance and set AdminCount to 1 for all users who remain in protected groups. Therefore, AdminCount and inheritance are set correctly for all users who are no longer members of protected groups.

Use the following command to run the script: Microsoft provides programming examples for illustration only, without warranty either expressed or implied. This includes, but is not limited to, the implied warranties of merchantability or fitness for a particular purpose. This article assumes that you are familiar with the programming language that is being demonstrated and with the tools that are used to create and to debug procedures. Microsoft support engineers can help explain the functionality of a particular procedure, but they will not modify these examples to provide added functionality or construct procedures to meet your specific requirements. To make sure that you do not adversely affect users, we recommend that you first dump the users who have AdminCount set to 1 by using Ldifde.exe. To do this, type the following command at a command prompt, and then press ENTER: Review the output file to confirm that all users who will have the DACL protected bit cleared will have the correct permissions with inherited access controlled entries (ACEs) only. This method is preferred and does not weaken existing security.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows Server 2003 Service Pack 1.

Active Directory uses a protection mechanism to make sure that ACLs are set correctly for members of sensitive groups. The mechanism runs one time an hour on the PDC operations master. The operations master compares the ACL on the user accounts that are members of protected groups against the ACL on the following object:
Note "DC=<MyDomain>,DC=<Com>" represents the distinguished name (DN) of your domain.

If the ACL is different, the ACL on the user object is overwritten to reflect the security settings of the adminSDHolder object (and ACL inheritance is disabled). This process protects these accounts from being modified by unauthorized users if the accounts are moved to a container or organizational unit where a malicious user has been delegated administrative credentials to modify user accounts. Be aware that when a user is removed from the administrative group, the process is not reversed and must be manually changed.

Note To control the frequency at which the adminSDHolder object updates security descriptors, create or modify the AdminSDProtectFrequency entry in the following registry subkey: When the AdminSDProtectFrequency registry entry is not present, the adminSDHolder object updates security descriptors every 60 minutes (3600 seconds). You can use this registry entry to set this frequency to any rate between 1 minute (60 seconds) and 2 hours (7200 seconds) by entering the value in seconds. However, we do not recommend that you modify this value except for brief testing periods. Modifying this value can increase LSASS processing overhead.

The following list describes the protected groups in Windows 2000:

• Enterprise Admins
• Schema Admins
• Domain Admins
• Administrators

The following list describes the protected groups in Windows Server 2003 and in Windows 2000 after you apply the 327825 hotfix or you install Windows 2000 Service Pack 4:

• Administrators
• Account Operators
• Server Operators
• Print Operators
• Backup Operators
• Domain Admins
• Schema Admins
• Enterprise Admins
• Cert Publishers

Additionally the following users are also considered protected:

• Administrator
• Krbtgt

Be aware that membership in distribution groups does not populate a user token. Therefore, you cannot use tools such as "whoami" to successfully determine group membership.

For more information about delegated administration, download the Best Practices for Delegating Active Directory Administration white paper. To do this, visit the following Microsoft Web site: