Interesting server issue

[clintblack]

We have 2 domain servers: 1 2003 Server Enterprise and 1 Windows NT Server 4.0. Recently, we took two users out of the domain admin group and put them into the following groups:
Account Operators
Backup Operators
Server Operators
Print Operators
The domain admins also have a separate account for using e-mail, etc. These account belong in the domain users group plus a few other groups for certain share access.

Here is the problem: one of the two users mentioned above left the company. I am unable to disable his account from the other former domain admin account. However, I was able to disable his regular user account without a problem. Is there some reason why this is happening? Account operators should be able to disable other account operators. Right?

 

[TheLad]

This TID should answer your questions in the MORE INFORMATION section

http://support.microsoft.com/kb/245174/en-us

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[clintblack]

I am not getting an "access denied" error. The boxes are just greyed out. It isn't like this with regular domain users. Any other suggestions?

 

[clintblack]

Wait a second, I see what you mean by the last post. Thanks man. Anyway, I have another issue that may be related to this:

Every user who has a normal user account has a mapping to a user folder on the primary domain controller. For some reason, my admin account-turned Account Operators, Backup Operators, Server Operators, Print Operators account cannot change the security permissions on these user folders. Why not?

 

[kmcferrin]

Probably because they don't have the filesystem rights necessary to modify those folders. Most likely the Domain Admins group does have rights to those folders, but your special users are no longer domain admins.