TheScullster

Hi all

Total AD novice here.
Windows Server2003, Exchange Server2003

A bit of background to the problem.......
I have a number of users with Blackberry devices controlled by a BES server.
For the arrangement to work, the BES administration account needs send and
receive permissions for each Blackberry user.
I don't understand how this was set up, but adding the user to a Blackberry
users group should make this happen.
However AIUI, it is necessary for the "Allow inheritable permissions.."
checkbox to remain ticked on the Advanced tab under the user's security
settings for these permissions to stay in place.
For some reason, one user in particular keeps losing the tick from this tick
box and, as a result, losing the entries for the BES administrator account
to access his mailbox.

Anyone any ideas why this is please?

TIA

Phil

Anthony [MVP]

Hi Phil,
This sounds like AdminSDHolder at work. It automatically resets the security
attributes of accounts in the built-in admin groups. This prevents people
from changing accounts that have greater admin rights than they do.
You should not need to change it.
Hope that helps,
Anthony
http://www.airdesk.com


"TheScullster" <phil@dropthespam.com> wrote in message
news:aYWdnXny_rST8yvVRVnyigA@eclipse.net.uk...
> Hi all
>
> Total AD novice here.
> Windows Server2003, Exchange Server2003
>
> A bit of background to the problem.......
> I have a number of users with Blackberry devices controlled by a BES
> server.
> For the arrangement to work, the BES administration account needs send and
> receive permissions for each Blackberry user.
> I don't understand how this was set up, but adding the user to a
> Blackberry users group should make this happen.
> However AIUI, it is necessary for the "Allow inheritable permissions.."
> checkbox to remain ticked on the Advanced tab under the user's security
> settings for these permissions to stay in place.
> For some reason, one user in particular keeps losing the tick from this
> tick box and, as a result, losing the entries for the BES administrator
> account to access his mailbox.
>
> Anyone any ideas why this is please?
>
> TIA
>
> Phil
>

TheScullster

"Anthony [MVP]" wrote

> Hi Phil,
> This sounds like AdminSDHolder at work. It automatically resets the
> security attributes of accounts in the built-in admin groups. This
> prevents people from changing accounts that have greater admin rights than
> they do.
> You should not need to change it.
> Hope that helps,
> Anthony

Thanks Anthony

Looking up the AdminSDHolder showed that issues like this include members of
Print Operators group.
I had added the user to this group not long ago so this may well be the
cause.
I have removed him from the group and re-applied the "Inherit permissions.."
tick, so will find out later whether this is resolved

Cheers

Phil