A detailed list of Protected Objects follows below. These are highly privileged objects which are vital for AD, such as members of the group 'Domain Admins' or 'Schema Admins'.

The process looks for so-called protected objects.

See topic below on how to influence the frequency of 60 minutes.

A process called SDPROP (Security Descriptor Propagation ) is automatically activated every 60 minutes on the PDC emulator of the Active Directory domain.What is going on here? Quite simply, the AdminSDHolder mechanism is the reason: Always with the same the error message: Access Denied / Insufficient permissions.Įxamining the phenomenon in more detail, we find that here the inheritance of permissions is disabled on the those objects: Permissions set on a parent OU do not apply to the object any more:Įven stranger: If you want to correct this and activate the permission inheritance again (check the 'Include inheritable permissions from the object's parent' option), then the permissions are normal for a while, but after about an hour, the inheritance is deactivated again!

Maybe a help desk staff or user object admin can no longer reset a password of a particular user, or can not change any telephone number or email address for accounts, or can not add new members to a specific group. When dealing with Active Directory object permissions, AD administrators often notice a strange effect: Permissions that have been set at the level of a specific OU suddenly don't apply any more to certain users or groups which are stored in that OU. Tool: Find objects where the permission inheritance is blocked

Active directory ou permissions report