Windows Forum

Ask something
Discussion Locked

account operator problem

0 helpful
7 replies

by and_the_beat_goes_on

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have NT4.0, sp6a, I created an user with account operator privledges. When I log on to the PDC or any BDC with that profile I am able to access and modify the global and local GROUP accounts. However, when I try to access an individual profile (for example to unlock an account) I get an Access is Denied message. I do not know what would cause this. Any help would be appreciated. Thanks.

7 replies

by curacao_dejavu

if that account is a also a account operator or a account with higher privileges you may not modify it, and you will get that error message.

Leopold

by and_the_beat_goes_on

The users that I have tried to access are regular everyday users who do not have any authority other than domain users and perhaps a member of the purchasing or sales group. Thanks anyway.

by admin-stuart

Sometimes NT's built-in groups such as Account Operators can become corrupt. If that's the case here, you will need to overwrite the built-in groups with a fresh copy through replication. Here's one way:

Install a new BDC to your domain, using acomputer that has never been a BDC before. Immediately promote this BDC to PDC, don't hesitate, you must do it before it requests a copy of the database from PDC with the corrupted groups.

Once done, synchronize the domain manually using the command "net accounts /sync". The clean accounts from your newly created BDC-promoted-to-PDC will overwrite only the corrupted built in accounts on the old PDC-demoted-to-BDC without disturbing the rest of the SAM accts.

You can now promote the former PDC back to PDC status, and remove the BDC you created from the domain, if you wish.

Good luck.

This discussion is closed to new replies.