Account Operator unable to disable domain user

[Guest]

I have a manager who I have set up to manage an organizational unit using delegate authority. While this works fine for most of their employees, there is one that they are unable to enable/disable or change any of the properties of. This person is also set up (apparantly) as an domain user, user, dial, remote. Basically it looks like the other users

What can I check outside of members of and security tabs in the profile that would actually relate to this person?

 

[David Adner]

Check the security permissions on the problem user's object. You need
to be in Advanced view to see the tab. All the delegation wizard really
does is go through change the ACL's on the various objects, granting the
relevant permissions. So try comparing a "good" and the "bad" objects'
permissions and see if you notice a discrepency.

 

[Joe Richards [MVP]]

Check the ACL on the user object. Verify that inheritence is on. If the user
was ever part of a group with enhanced permissions such as admins, account
ops, etc they may have the admincount attribute set which means the ACL is
being handled by the adminsdholder functionality which overrides other
security placed on the account.

--
http://www.joeware.net (download joeware)
http://www.cafeshops.com/joewarenet (wear joeware)

I have a manager who I have set up to manage an organizational unit using

delegate authority. While this works fine for most of their employees,
there is one that they are unable to enable/disable or change any of the
properties of. This person is also set up (apparantly) as an domain user,
user, dial, remote. Basically it looks like the other users.

What can I check outside of members of and security tabs in the profile

that would actually relate to this person?