JSI Tip 5030. AdminSDHolder Thread Affects Transitive Members of Distribution Groups?

Microsoft Knowledge Base Article 318180 contains the following summary:

An Active Directory domain controller that holds the primary domain controller (PDC) operations master role (also known as the flexible single master operations role or the FSMO role) runs a thread every hour to check the access control lists (ACLs) on the following groups and all of the member objects of these groups:

Enterprise Admins
Schema Admins
Domain Admins
Domain Controllers
Cert Publishers
Backup Operators
Replicator Server Operators
Account Operators
Print Operators

If a user account is a member of one of these administrative groups because of its membership with a distribution group, the user account's ACL is checked when the thread is run and may be reset to match the ACL of the AdminSDHolder thread. If you use the repadmin /showmeta user distinguished name command to view the user account, you see that the ntSecurityDescriptor attribute is set within one hour after the last time you changed the ACL on the user account. The user account also contains the AdminCount attribute.

This article describes how the AdminSDHolder thread affects transitive members of distribution groups.

For additional information about the AdminSDHolder thread, click the following article number to view the article in the Microsoft Knowledge Base:

232199 Description and update of Active Directory AdminSDHolder object

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.