Return
-
Title
Applied Active Template to root of domain to deny user account deletions to a specific group, and it is not working -
Description
Trying to deny all Active Directory users from being able to delete user accounts. The Active Template has the permission set to explicitly "Deny" on "Delete User Objects". This is applied to a global security group and set at the root of the domain. Users in the security group are still able to delete user accounts.
-
Cause
Since applying the permission at the root domain level, the OU's that contain the users are now showing as inherited "Deny" permissions.Inherited "Deny" permissions do not prevent access to an object if the object has an explicit "Allow" permission entry.Explicit permissions take precedence over inherited permissions, even inherited Deny permissions. -
Resolution
Apply the template to each OU that contains user accounts.
