Gremlins in AD? Security settings reset

[Bontebok]

Hello All,

I'm trying to give permission to the "Account Operators" group over a user object in AD. Everytime I do, about 30 minutes or so later, the setting gets reset and I have to go back and set it again.

Does anyone know what is causing this setting to get reset and how to disable/fix it?

Thanks,

Bontebok

 

[Davetoo]

Check for a domain policy overriding a local assignment.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[Bontebok]

We have looked at the Domain Policy, we can't find anything wrong.

If I make the change on one of the Domain Controllers, replicate to the other, both DCs will have the correct copy. Then about 30 minutes later, the security setting is removed.

This is really confusing. Any ideas?

 

[karlisi]

Exactly the same for me on one User's account and I am the Account operator This is only object I have no ownership, so I think someone from Account operators group shoud take ownership on this account (first you must give full access for this group).
My domain admins are very slow, so I have not tried this. If you are in luck post here.

===
Karlis
ECDL; MCP

 

[royboy42]

Check to see that you don't have a domain builtin security group within another builtin security group. Eg, have users part of account operators, or account operators part of print operators. This can cause ad to reset your settings.

Regards

Roy

MCSE, CCA

 

[silverspecv]

Did you check the GP under restricted groups?