Delegation Rights

[goosed]

I've created a delegation group.. which has been working well. However recently my Helpdesk staff has said they've been unable to reset certian user accounts. Sure enough when I login using an account in the Helpdesk group I also cannot reset certian accounts.


My question is why is this like this? Same OU's.. only some users are not editable where others are.

 

[ELBeast]

Are any of the users that are not editable members of protected groups?

http://support.microsoft.com/kb/817433

(Delegated permissions are not available and inheritance is automatically disabled)

 

[goosed]

Interesting find ELBeast. From that article it shows that protected groups are:

* Enterprise Admins
* Schema Admins
* Domain Admins
* Administrators

However when I checked the non-editable users, none were in a protected group. So frustrating..

 

[goosed]

I actually figured it out. For some reason on non-editable accounts, the option to "Allow inheritable permissions" was unchecked. After checking it, all the accounts that were non-editable are working.

Thanks for the help!

 

[ELBeast]

Glad you figured it out, however if after an hour or so the "Allow inheritable permissions" is once again unchecked, then those users are definitely in a protected group. That list you posted is true for Windows 2000 pre-service pack 4.

The following list describes the protected groups in Windows Server 2003 and in Windows 2000 after you apply the 327825 hotfix or you install Windows 2000 Service Pack 4:

* Administrators
* Account Operators
* Server Operators
* Print Operators
* Backup Operators
* Domain Admins
* Schema Admins
* Enterprise Admins
* Cert Publishers

Additionally the following users are also considered protected:

* Administrator
* Krbtgt

I had this problem because my users were in the Print Operators group, I fixed it by removing the Print Operators
protected group status.