Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

How do I reset default security on a (many) user object(s)?

4 views
Skip to first unread message

Carl Browning

unread,
Jan 14, 2003, 4:56:52 AM1/14/03
to
I had an unfortunate incident the other day where an admin accidentally
added many accounts that were supposed to be added to a local machine
Administrators group into the domain Administrators group. As expected,
this reset the security on these user objects to the standard AdminSDHolder
values. I was able to move the users to the correct group, but the security
on the user objects has remained at the AdminSDHolder values. The Account
Operators can no longer modify attributes of this group of users (and this
makes them cranky).

Is there a way that I can easily reset the security on these user objects
back to the default values? I really do not want to manually add each value
back in to each user (there are quite a few).

Any help would be greatly appreciated.

Thanks,
Carl

Jerold Schulman

unread,
Jan 14, 2003, 7:54:12 AM1/14/03
to
On Tue, 14 Jan 2003 01:56:52 -0800, "Carl Browning" <carlbr...@attbi.com>
wrote:

See tip 5571 in the 'Tips & Tricks' at http://www.jsiinc.com or type 'jsi <tip
number>' into the Address bar after implementing tip 6000.

Jerold Schulman
Windows Server MVP / Configuration Management
JSI, Inc.
http://www.jsiinc.com

Rabbit

unread,
Jan 14, 2003, 4:34:34 PM1/14/03
to

"Jerold Schulman" <Je...@jsiinc.com> wrote in message
news:it182vku61d48vr94...@4ax.com...

This is something I'm looking at at the moment, but don't see how your tip
helps as it doesn't mention the actual security on the user objects that the
OP (and myself) are interested in, just policies etc. I'd appreciate some
clarification.

The method I'm experimenting with revolves around using two DSACLS calls for
each 'faulty' user (credit to MS PSS for help with this), :

DSACLS "cn=x,cn=users,DC=domain,DC=com" /P:N /R Guest
turns on the Inherit Permissions flag (/R Guest is required to make the
command actually function) and

DSACLS "cn=x,cn=users,DC=domain,DC=com" /S
resets the permissions to the original schema.

Just need to wrap this into a script and job done (hopefully)!


Carl Browning

unread,
Jan 15, 2003, 2:28:10 AM1/15/03
to
Boy Howdy, Rabbit! Thank you very much. That was exactly what I was
looking for. Works perfectly.

Carl

"Rabbit" <rab...@the.hutch> wrote in message
news:NI%U9.126$E_3....@newsfep4-gui.server.ntli.net...

0 new messages