03-19-2008, 06:08 PM
Talking BlackBerry Encyclopedia
Join Date: Feb 2007
Post Thanks: 0
Thanked 0 Times in 0 Posts
Account Operators and Print operators are also protected groups, this will also revoke the Send As permission.
There is another work around if you are comfortable doing it.
Dont quote me on any of this, but I do know that it works, you will still need to set the Send As right for Besadmin on the User objects, but this will stop users of protected groups from having it revoked.
If you enable inheritance on the adminSDHolder container, all members of the protected groups have inherited permissions enabled. In terms of security functionality, this method reverts the behavior of the adminSDHolder container back to the pre-Service Pack functionality.
NOTE: If you use Active Directory Users and Computers, make sure that Advanced Features is selected on the View menu.
To enable inheritance on the adminSDHolder container:
1. Right-click the container, and then click Properties.
2. Click the Security tab.
3. Click Advanced.
4. Click to select the Allow Inheritable permissions to propagate to this object and all child objects check box .
5. Click OK, and then click Close.
The next time that the SDProp thread runs, the inheritance flag is set on all members of protected groups. This procedure may take up to 60 minutes. Allow sufficient time for this change to replicate from the primary domain controller (PDC).