Delegated permissions are not available and inheritance is automatically disabled

Windows 2000 hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Windows Server 2003 service pack information

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

889100 How to obtain the latest service pack for Windows Server 2003

Windows Server 2003 hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Method 1: Make sure members are not members of a protected group

If you use permissions that are delegated at the organizational unit level, make sure that all users who require the delegated permissions are not members of one of the protected groups. For users who were previously members of a protected group, the inheritance flag is not automatically reset when the user is removed from a protected group. To do this, you can use the following script.

Note This script checks the inheritance flag for all users whose AdminCount is set to 1. If inheritance is disabled (SE_DACL_PROTECTED is set), the script will enable inheritance. If inheritance is already enabled, inheritance will remain enabled. Additionally, AdminCount will be reset to 0. When the adminSDHolder thread runs again, it will disable inheritance and set AdminCount to 1 for all users who remain in protected groups. Therefore, AdminCount and inheritance are set correctly for all users who are no longer members of protected groups.

Important: If you're running this script from a system running Windows Vista and above, please open a cmd prompt with administrative priviledges and then run this script.

Use the following command to run the script:

cscript /nologo resetaccountsadminsdholder.vbs

Microsoft provides programming examples for illustration only, without warranty either expressed or implied. This includes, but is not limited to, the implied warranties of merchantability or fitness for a particular purpose. This article assumes that you are familiar with the programming language that is being demonstrated and with the tools that are used to create and to debug procedures. Microsoft support engineers can help explain the functionality of a particular procedure, but they will not modify these examples to provide added functionality or construct procedures to meet your specific requirements.

'********************************************************************
'*
'* File:           ResetAccountsadminSDHolder.vbs 
'* Created:        November 2003
'* Version:        1.0
'*
'*  Main Function:  Resets all accounts that have adminCount = 1 back
'*to 0 and enables the inheritance flag
'*
'*  ResetAccountsadminSDHolder.vbs 
'*
'* Copyright (C) 2003 Microsoft Corporation
'*
'********************************************************************

Const SE_DACL_PROTECTED = 4096

On Error Resume Next

Dim sDomain
Dim sADsPath
Dim sPDC


Dim oCon 
Dim oCmd
Dim oRst
Set oRst = CreateObject("ADODB.Recordset")
Set oCmd = CreateObject("ADODB.Command")
Set oCon = CreateObject("ADODB.Connection")

Dim oRoot
Dim oDomain
Dim oADInfo
Dim oInfo
Set oADInfo = CreateObject("ADSystemInfo")
Set oInfo = CreateObject("WinNTSystemInfo")
sPDC = oInfo.PDC & "." & oADInfo.DomainDNSName

oCon.Provider = "ADSDSOObject"
oCon.Open "Active Directory Provider"

oCmd.ActiveConnection = oCon

Set oRoot = GetObject("LDAP://rootDSE")
sDomain = oRoot.Get("defaultNamingContext")
Set oDomain = GetObject("LDAP://" & sDomain)
sADsPath = "<" & oDomain.ADsPath & ">"

oCmd.CommandText = "SELECT ADsPath FROM 'LDAP://" & sPDC & "/" & sDomain & "' WHERE objectCategory='person' and objectClass = 'user' AND adminCount = 1"
Set oRst = oCmd.Execute

WScript.Echo "searching for objects with 'admin count = 1' in " & sDomain

If oRst.RecordCount = 0 Then
    WScript.Echo "no accounts found"
    WScript.Quit
End If

Do While Not oRst.EOF
    WScript.Echo  "found object " & oRst.Fields("ADsPath")
    If SetInheritanceFlag(oRst.Fields("ADsPath")) = 0 Then WScript.Echo "Inheritance flag set"
    If SetAdminCount(oRst.Fields("ADsPath"), 0) = 0 Then WScript.Echo "adminCount set to 0"
    WScript.Echo  "=========================================="
    oRst.MoveNext
Loop


Private Function SetInheritanceFlag(DSObjectPath)

    Dim oSD
    Dim oDACL
    Dim lFlag
    Dim oIADs

    Set oIADs = GetObject(DSObjectPath)

    Set oSD = oIADs.Get("nTSecurityDescriptor")

    If oSD.Control And SE_DACL_PROTECTED Then
        oSD.Control = oSD.Control - SE_DACL_PROTECTED
    End If

    oIADs.Put "nTSecurityDescriptor", oSD
    oIADs.SetInfo

    If Err.Number <> 0 Then
        SetInheritanceFlag = Err.Number
    Else
        SetInheritanceFlag = 0
    End If

End Function


Private Function SetAdminCount(DSObjectPath, AdminCount)

    Dim oIADs
    Dim iAdminCount

    Set oIADs = GetObject(DSObjectPath)

    iAdminCount = oIADs.Get("adminCount")

    If iAdminCount = 1 Then iAdminCount = 0

    oIADs.Put "adminCount", iAdminCount
    oIADs.SetInfo
    If Err.Number <> 0 Then
        SetAdminCount = Err.Number
    Else
        SetAdminCount = 0
    End If

End Function

To make sure that you do not adversely affect users, we recommend that you first dump the users who have AdminCount set to 1 by using Ldifde.exe. To do this, type the following command at a command prompt, and then press ENTER:

ldifde -f Admincount-1.txt -d dc=your domain -r "(&(objectcategory=person)(objectclass=user)(admincount=1))" Review the output file to confirm that all users who will have the DACL protected bit cleared will have the correct permissions with inherited access controlled entries (ACEs) only. This method is preferred and does not weaken existing security.

Method 2: Enable inheritance on the adminSDHolder container

If you enable inheritance on the adminSDHolder container, all members of the protected groups have inherited permissions enabled. In terms of security functionality, this method reverts the behavior of the adminSDHolder container back to the pre-Service Pack 4 functionality.

Method 3: Avoid inheritance and only change ACLs

If you do not want users who are members of Protected Groups to inherit permissions from the container that the users reside in, and you only want to change the security on the user objects, you can edit the security on the adminSDHolder container directory. In this scenario, you do not have to enable Inheritance on the adminSDHolder container. You only have to add that group or edit the security of the security groups that are already defined on the adminSDHolder container. After one hour, the SDProp thread will apply the change made to the ACLs of the adminSDHolder container to all the members of protected groups. The members will not inherit the security of the container they reside in.

For example, the Self account requires the Allow to Read All Properties right. Edit the adminSDHolder container security settings to allow this right on the Self account. After one hour, this right will be allowed to the Self account for all users who are members of protected groups. The Inheritance flag is not changed.

The following example demonstrates how to apply changes onto the adminSDHolder object only. This example grants the following permissions on the
adminSDHolder object:

• List Contents

• Read All Properties

• Write All Properties

To grant these permissions on the adminSDHolder object, follow these steps:

1. In Active Directory Users and Computers, click
   Advanced Features on the Viewmenu.

2. Locate the adminSDHolder object. The object is in the following location for each domain in the Active Directory forest:
   CN=adminSDHolder,CN=System,DC=domain,DC=com Here,
   DC=domain,DC=com is the distinguished name of the domain.

3. Right-click adminSDHolder, and then click
   Properties.

4. In the Properties dialog box, click the
   Security tab and then click Advanced.
   

5. In the Access Control Settings for adminSDHolder dialog box, click Add on the
   Permissions tab.

6. In the Select User, Computer, or Groupdialog box, click the account to which you want to grant related permissions, and then click OK.

7. In the Permissions Entry for adminSDHolderdialog box, click This object only in the Apply onto box, and then click List Contents, Read All Properties, and Write All Properties rights.
   

8. Click OK to close the Permissions Entry for adminSDHolder dialog box, the Access Control Settings for adminSDHolder dialog box, and the adminSDHolder Properties dialog box.

Within one hour, the ACL will be updated on the user objects associated with the protected groups to reflect the changes.For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

232199 Description and update of the Active Directory adminSDHolder object

318180 AdminSDHolder thread affects transitive members of distribution groups