Prev: windows 2008 machine joining problem
Next: cannot join WinXP to Windows 2000 domain
From: mpatraw_EPIC_Imaging on 4 Jun 2008 13:21
Used dsacls with the /S /T switch to update Users tree of objects to ACL
defaults. If you do this be careful as the tool doesn't work as indicated.
Under DsAcls Help, Syntax reads:
"/T
Restores the security on the tree of objects to the default for each object
class. This parameter is valid only with the /S parameter."

However Built-In groups such as Domain Admins, Enterprise Admins and others
were also modified to add the Account Operators group and grant full access.
I guess I could be reading this wrong, but I consider Users and Built-In
groups to be different object classes.

Anyway, I removed the Account Operators group from those built-in groups and
all is well.

Thanks to everyone for their input and help on this issue.

"mpatraw_EPIC_Imaging" wrote:

> Removed end users from Print Operators and checked all other Built-In groups
> to ensure they did not contain normal users. Have waited more then 7 hours
> and Account Operators has not been added to any of the user account objects
> ACE's that were missing it before.
>
> Is the
>
> "Herb Martin" wrote:
>
> >
> > "Richard Mueller [MVP]" <rlmueller-nospam(a)ameritech.nospam.net> wrote in
> > message news:uQApoZbwIHA.3384(a)TK2MSFTNGP03.phx.gbl...
> > > I'm glad this accounts for what you see. Yes, changing membership in the
> > > Printer Operators group will make the ACE get added or removed as
> > > appropriate, but there is a time delay. A system process does this in the
> > > background. You may need to wait 15 minutes or so.
> >
> > Amazing (since) I didn't know that <grin>
> >
> >
> >
First  |  Prev  | 
Pages: 1 2 3 4
Prev: windows 2008 machine joining problem
Next: cannot join WinXP to Windows 2000 domain