Active Directory permissions resetting themselves

[TaylorDavidI]

I've been tasked with locking down the permissions of our tech support team at work. I know the permissions everyone needs and I can set them without interfering with anyone's work.

The problem comes a few minutes later (possible when the domain controllers replicate, but I'm not sure). At this point most of the changes I just spent 20-30 minutes making are all thrown out.

Specifically: enabling inheritance on several user objects, removing the "Allow, Everyone, Change Password" permission on each technical user's account and a few other minor changes.

I'm making the changes while logged into the operations master for Active Directory and as the enterprise administrator account created when the domain was created. The domain is functioning at the Server 2003 Domain Function Level. No one else is working with active directory at the times I make the changes but it's happened about 7 times now.

Can anyone explain how to fix this problem or at least tell me what might be making the changes.

Thanks for any help you can give me,

David I. Taylor
A+, Network+, MCP Windows XP

 

[TaylorDavidI]

After further investigation I've found out that, suprisingly, the users who's objects would not accept inheritance are actually members of the administrators group.

I'm not sure why some of these users were given so much power but at least I know why the problem was occuring.

David I. Taylor
A+, Network+, MCP Windows XP