RBAC Inheritance Broken on Active Directory OU

Question

Newly created accounts in an OU fail to inherit baseline security permissions. How do we re-enable permission inheritance using Active Directory tools?

Answer

If inheritance is broken at the OU level, re-enable it on the OU so domain or parent OU permissions can flow down to newly created accounts.

Steps in Active Directory Users and Computers:

Open Active Directory Users and Computers.
Locate the affected OU.
Right-click the OU and select Properties.
Open Security > Advanced.
If Enable Inheritance is shown, select it.
Verify inheritance is also enabled on every parent OU or container above it, because permissions must cascade from the domain level down to the target OU.

Expected result:

Baseline permissions inherited from the parent hierarchy become applicable to the OU.
Newly created accounts in that OU can inherit those permissions.

If the issue involves protected accounts or groups, note that protected objects have inheritance disabled by design through AdminSDHolder. In that case, either:

ensure the affected users are not members of protected groups, or
if inheritance must be restored broadly for protected objects, inheritance can be enabled on the adminSDHolder container using Active Directory Users and Computers or ADSI Edit.

To enable inheritance on adminSDHolder in Active Directory Users and Computers:

In View, enable Advanced Features.
Go to CN=adminSDHolder,CN=System,DC=,DC=.
Right-click the container and select Properties.
Open Security > Advanced.
Select Allow Inheritable permissions to propagate to this object and all child objects.
Select OK and Close.

Important: Enabling inheritance on adminSDHolder changes the protection model for members of protected groups. The change can take up to 60 minutes to be applied by SDProp and additional time to replicate.

A safer alternative for protected accounts is to remove users from protected groups when appropriate, then reset inheritance for accounts that are no longer supposed to remain protected.

Troubleshoot insufficient access rights error
Delegated permissions are not available and inheritance is automatically disabled
Delegated permissions are not available and inheritance is automatically disabled

Answer

Hola Emma,

Check the affected user object and the OU, because enabling inheritance on the OU won't restore it for a user whose own inheritance is disabled. In Active Directory Users and Computers, select View > Advanced Features, then open the affected user's Properties > Security > Advanced. If Enable inheritance is displayed, inheritance is currently disabled. For an ordinary, nonprotected account, select it and Apply, then confirm that the expected entries appear with an "Inherited from" source.

If inheritance is already enabled, check the parent OU for the missing permission under Properties > Security > Advanced. Its "Applies to" scope must include the relevant user objects; an entry scoped to "This object only" won't reach newly created users. Microsoft explains object-specific inheritance here.

I'd avoid changing AdminSDHolder as suggested in the automated answer. It's the permissions template for protected accounts across the domain, so changing it can affect privileged-account security well beyond this OU. If inheritance becomes disabled again, check whether the user belongs directly or through nested groups to a protected group, such as Domain Admins or Account Operators.

Which specific permission is missing, and does the affected user's Advanced Security window show "Enable inheritance" or "Disable inheritance"? That will help distinguish blocked inheritance from an incorrectly scoped delegation.

Thanks,

James

RBAC Inheritance Broken on Active Directory OU

2 answers

Your answer