Introducing the Active Directory Discussion Blog....

re: Introducing the Active Directory Discussion Blog....

Tim Springston [MS] — Tue, 08 May 2007 17:06:27 GMT

Hi Shaun-

I think it would be a good idea to review the permissions that are there. And perhaps to verify that the security group you used is, in fact, on the users token.

For the OU and object permissions part you can use DSACLS.EXE to dump them to a text file and review them. It's generally easier than going through the properties sheet of each.

More on that is here: http://support.microsoft.com/default.aspx/kb/281146

For the token, there's a lot of different ways to check this. A nice GUI one is to use Process Explorer and look at the security tab of the Properties of Explorer.exe.

Process Explorer can be gotten here:

http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

Hope this helps!

Tim Springston

Microsoft Corporation

These postings are provided "AS IS" with no warranties, and confer no rights.

re: Introducing the Active Directory Discussion Blog....

Shaun G — Thu, 03 May 2007 22:00:49 GMT

Hello,

In AD, there is an OU that is inheriting from the parent Org. I have added a specific security group to have permissions to this ou, and all object. however, when logged in as a user of the security group, I receive the following error.

The Active Directory object could not be displayed. Unable to view attribute or value. You may not have permissions to view this object.

Kind of stumped on this one, any ideas?

re: Introducing the Active Directory Discussion Blog....

aicchong — Sat, 10 Jun 2006 00:16:33 GMT

Great. Hope to see your technical post soon.