{"id":109,"date":"2019-01-10T22:09:07","date_gmt":"2019-01-11T03:09:07","guid":{"rendered":"http:\/\/itblog.ldlnet.net\/?p=109"},"modified":"2019-01-29T20:12:00","modified_gmt":"2019-01-30T01:12:00","slug":"protected-ad-groups-and-the-problems-they-can-cause-accounts","status":"publish","type":"post","link":"https:\/\/itblog.ldlnet.net\/index.php\/2019\/01\/10\/protected-ad-groups-and-the-problems-they-can-cause-accounts\/","title":{"rendered":"Protected AD Groups and the problems they can cause accounts"},"content":{"rendered":"\n

I have run into this issue over the years with accounts being in the Domain Admins group and having issues running PowerShell cmdlets as well as not being able to connect to ActiveSync from a mobile device with the account.<\/p>\n\n\n\n

These issues are due to the AdminSDHolder<\/em> Template in AD and the SDProp Process<\/em> that is run every 60 Minutes in AD.
This is explained in fantastic detail through the following Microsoft article: Protected Accounts & Groups In Active Directory<\/a><\/strong><\/p>\n\n\n\n

Here is an example of an issue that occurred in one of the environments that I was managing. A user was trying to run the following AD cmdlet in PowerShell on DC01:<\/p>\n\n\n

Set-ADUser lancel -Server dc01.ldlnet.org -Replace @{title=\"Senior Operations Engineer\"}<\/pre>\n\n\n\n
The user got the following error when the cmdlet was executed:<\/p>\n\n\n\n
Set-ADUser : Insufficient access rights to perform the operation
At line:1 char:1
+ Set-ADUser lancel -Server dc01.ldlnet.org -Replace @{title=”Senior O …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo: NotSpecified: (lancel:ADUser) [Set-ADUser], ADException
+ FullyQualifiedErrorId : ActiveDirectoryServer:8344,Microsoft.ActiveDirectory.Management.Commands.SetADUser<\/p>\n\n\n\n
The issue was that the admin account used to run the cmdlet was in the Domain Admins<\/em> group and was not inheriting permissions per the AdminSDHolder<\/em> template that was applied to the account:<\/p>\n\n\n\n
I checked to see that the admin account was in a protected group:<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
I next went to the Security Tab > Advanced Button and saw that the Enable Inheritance <\/em>button was visible:<\/p>\n\n\n\n
\"\"
I’ve circled where to look in the window.<\/figcaption><\/figure><\/div>\n\n\n\n
This verifies that the account is protected due to being in the Domain Admins<\/em> group. Now, there are two workarounds for this particular error that we were experiencing.<\/p>\n\n\n\n
  1. Click the Enable Inheritance<\/em> button. This will cause the permissions to be inherited temporarily.<\/strong> <\/em>When SDProp is cycled again, the account will lose any inherited permissions and will be essentially “broken” again. This is not good if you’re going to be running cmdlets regularly to modify AD Accounts.<\/li>
  2. The preferred method to work around this issue is to set the -Server parameter to point to a different DC than the one you are on. So, essentially, we tell the cmdlet to execute on DC02 when running the cmdlet from DC01.<\/li><\/ol>\n\n\n
    Set-ADUser lancel -Server dc02.ldlnet.org -Replace @{title=\"Senior Operations Engineer\"}<\/pre>\n\n\n\n
    Either method will allow the cmdlet to execute successfully and modify the object. You would think that Microsoft would have noticed this issue with running an admin cmdlet for Active Directory, but they have not fixed this issue as of yet nor do i think they plan to. I would just go with workaround number two and remain sane.<\/p>\n\n\n\n
    Another example of this Protected Group issue comes with an account in a Protected Group that has a mailbox not being able to connect to Exchange ActiveSync when setting up their mobile device. <\/p>\n\n\n\n