What overrides AD settings?

[susan]

Something keeps unchecking "Allow inheritable permissions
from parent to propergate to this object." on users
accounts (security tab). What can override Active
Directory settings?

 

[Matjaz Ladava [MVP]]

If the account is parrot of some specific (Admin) groups, then you are
seeing the work of AdminSDHolder resetting your permissions. See
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q318180

--
Regards

Matjaz Ladava, MCSE, MCSA, MCT, MVP
Microsoft MVP - Active Directory
(e-mail address removed), (e-mail address removed)
http://ladava.com

 

[Gene]

FYI, this can also be an indication of a corrupted
directory structure....hopefully Matjaz's article
reference will resolve it for you though.

 

[Gene Rosenacker]

Unfortunately there is not a tool to do this, but
diagnosis with several tools and some AD troubleshooting
experience typically indicate the directory is corrupted.

Not as easy as it all sounds. Good luck.

 

[Joe Richards [MVP]]

I haven't seen a case of a corrupted directory that didn't result in a shit load of AD errors in the event logs. I
would look at directory corruption as the last possible cause of this without that evidence.

As Matjaz indicates, this is almost certainly a function of adminsdholder.