Quote:
Originally Posted by costonbw
It looks like my latest problem has to do with the AdminSDHolder and the fact that it sets the accounts security-descriptor is set not to inherit permissions from parent objects for members of certain administrative groups. Now that the groups are not administrators any more I've changed the security-descriptor to inherit permissions again and the "Send As" rights now flow to the accounts, but my test messages still fail. I'm thinking this may be a re-fresh issue now though.
What a mess...
|
Well, it turns out that AdminSDHolder does allot, and one of those things is to break rights inheritance for Administrator users. This is to protect important user accounts from being taken over users who have been delegated the change password right, etc. After fixing inheritance on the problem users and waiting the prerequisite 30 minutes everything works.
The moral of this story... never mail enable accounts with "Administrator" privilege.