Delegate Control to Groups

[MNMike]

I have delegated the right to create computer accounts (default Computers OU) to a group call AddDelComputers. If I add a user to this group, the user cannot actually add computer accounts until I reapply the delegated permission? Is there any way to refresh this when I add/remove a user from the group without re-doing the delegation?

Thanks!
Mike

 

[hewissa]

How many DC's are in your network? Are you allowing for the new user to your AddDelComputers to replicate across the network. So that when the user does attempt to create the account, his authentication allows him to do so no matter what DC has done the authentication.


Also try the secedit /refreshpolicy cmd line. See

http://www.microsoft.com/windows200...ws2000/en/server/help/sag_secedit_refresh.htm

for more information.

You can also change the GPO refresh interval:

http://www.microsoft.com/windows200...chinfo/reskit/en-us/distrib/dsec_pol_sqjn.asp

Hope this points you in the right direction. Hewissa

MCSE, CCNA, CIW

 

[MNMike]

We only have two DC's (well four, two in the root domain, and two in our main/child domain). I let it sit all weekend, and it still wouldn't work this morning (I had changed group membership Friday afternoon). The original user that was no longer in the group could still create accounts, while the new user who was in the group could not. I thought it was reapplying the delegation that got it to work today, but that doesn't appear to be the case. This is really flaky!

 

[hewissa]

Check the event viewer on the DC's to see if there are errors in the File Replication Service.

I had something similar to this happen on my network and it came down to an error in the Domain level GPO that was disrupting everything throughout AD. I kept getting messages that the GPO's could not be applied Event bla bla bla...

See if you have any messages there. Sounds like replication is interupted or something. Hewissa

MCSE, CCNA, CIW

 

[MNMike]

There aren't any errors in the event logs on either server. I let it sit overnight and I still can't join a computer to the domain with the user account in my group that I've delegated permissions to.

Very strange... Any other thoughts?

Thanks,
Mike

 

[MNMike]

Oops! There was a replication problem between one of my forest root DC's... Turns out the time wasn't synching on this server. However, my delegation STILL doesn't work!

Any other ideas???

Thanks...Mike