Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,726 questions
AdminCount, SDProp and AdminSDHolder
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(9.6, 54%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EF%3C/text%3E%3C/svg%3E)
fnanfne
1
Reputation point
Started a new job recently and discovered the wonderful world of AdminCount, SDProp and AdminSDHolder as per subject.
My user account kept on being removed from the Domain Admins security group and I instantly knew what the problem was....Restricted Groups. How wrong I was. After some days, I discovered the AdminSDHolder OU.
Long story short, how do I go about adding myself to this "process" so that my user account does not get removed?
I found this Microsoft article useless and saw many YT videos showing how to "hack" this process by merely adding the user account to the ACL (or the security tab of the OU) but this is obviously not the correct way to go. Any help appreciated. Btw, I did try to change the ASD attribute called adminCount to 1, to no avail.
Thanks for reading.
Windows Server
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,958 questions
{count} votes
-
jLight 201 Reputation points2023-02-21T01:17:56.9466667+00:00 AdminSDHolder is to protect anyone on the DA or other protected groups. It will remove permissions not added to it (that were added by regular delegation). If you are being removed from the DA group, there might be a script or JIT/PIM process running to clear the membership? Maybe you're not in the approved list so it takes your account out?
Sign in to comment
Sign in to answer