Microsoft Knowledge Base Article 318180 contains the following summary:
An Active Directory domain controller that holds the primary domain controller (PDC) operations master role (also known as the flexible single master operations role or the FSMO role) runs a thread every hour to check the access control lists (ACLs) on the following groups and all of the member objects of these groups:
| • | Enterprise Admins |
| • | Schema Admins |
| • | Domain Admins |
| • | Administrators |
| • | Domain Controllers |
| • | Cert Publishers |
| • | Backup Operators |
| • | Replicator Server Operators |
| • | Account Operators |
| • | Print Operators |
If a user account is a member of one of these administrative
groups because of its membership with a distribution group, the user account's
ACL is checked when the thread is run and may be reset to match the ACL of the
AdminSDHolder thread. If you use the repadmin /showmeta user distinguished name command
to view the user account, you see that the ntSecurityDescriptor attribute is set within one hour
after the last time you changed the ACL on the user account. The user account also contains the AdminCount attribute.
This article describes how the AdminSDHolder
thread affects transitive members of distribution groups.
For additional information about the AdminSDHolder thread, click the following article number to view the article in the Microsoft Knowledge Base:
232199 Description and update of Active Directory AdminSDHolder object
