AGPM - Change Archive Owner - Domain Delegation inherited permissions

Hi,
I've just started to implement AGPM 4.0 SP1 on our domain and have got to the point of assigning roles.
Unfotunately, it looks like I made a bad choice during the initial installation. I assigned the Archive Owner role to the wrong security group and would like to change this.
It lists as an inherited permission in the Domain Delegation tab of the Change Control folder. However, I cannot find where the setting is inherited from and therefore I can't change it. I realise that I could remove the inherited permissions, but is this
the only option available to me, or can I alter it somewhere and assign another group this role?
Thanks,

Hi,
Link GPOs permission is assigned to members of Domain Administrators and Enterprise Administrators by default. To assign Link GPOs permission to additional users or groups (such as accounts that have the roles of AGPM Administrator or Approver), click the node
for the domain and then click the Delegation tab, select Link GPOs, click Add, and select users or groups to which you want to assign the permission.
For more information, please refer to the following article:
Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0
http://technet.microsoft.com/en-us/library/ee378482.aspx
Operations Guide for Microsoft Advanced Group Policy Management 4.0
http://technet.microsoft.com/en-us/library/ee390965.aspx
Regards,
Yan Li
Cataleya Li
TechNet Community Support

Similar Messages

How to change massively in some folders the permissions owner ?

Hi:
We have some folders in SAP Portals 2004s (7.0) with a user which is the ACL permission owner and the Services permission owner of these folders.
We need to change that owner massively in these folders to a group without using the user of that owner.
How can we do that ?
Thanks in advance,
Felipe Mendivil Ortiz

Hi Felipe,
it seems that you have missed one thing (in terms of understanding).
The System Principal is a special permission. It is like defining a super admin user who is able to do a lot of administrative things in the Knowledge Management platform. This special permission can be applied to every existing portal user (independent of the other permissions the user has) but also to a group or a role. All users assigned in that group or with that role will become a system principal and have the defined permissions.
As you've mentioned above, when you create a new system principal definition you can type the following:
1) Name - To be on the safe side I would use here the same UserId/RoleID/GroupID as in the User Name /Role Name /Group Name field.
2) Change Resource Permissions - If you check this box, as mentioned in SAP Help, the defined user/role/group is able to change resource permission for every resource (document or folder).
3) Service ACLs - Yes, here you define if the user/role/group should also be able to change service permissions for every resource (document or folder), or not.
4) Set System Properties - This is for properties that are not set over the UI (Details screen) but can only be set via API. Sometimes you want to have a system user, which you define as system principal and give him this permission to user this user to set system properties.
5) Unlock Permission - As mentioned in the SAP Help link, with this permission a system principal could remove document locks set by other users.
6) Resource Permissions - Here you define what the system principal (user/group/role) is allowed to do in KM (besides the above defined status of changing permissions). If you selected only READ, the system principal will only be able to read ALL resources (files/folders) in KM. It should be clear what happens if you define READ, WRITE, DELETE.
7) User Name - Type here the User ID of the user(s) that you want to give this system principal status. You can have here a comma separated list.
8) Audit Actions - By checking this box, every time the mentioned user changes permission / unlocks objects / etc. this action will logged. You will be able to see it in the [KM audit|http://help.sap.com/saphelp_nw04/helpdata/en/44/a9b4e2f9677455e10000000a11466f/frameset.htm].
You will not find a initial path definition, because you can not restrict a system principal on a special path. The system principal is defined global for ALL KM repositories.
Hope this clarifies all your questions,
Robert

Zipped folders are created without inherited permissions

When I create a zip folder, the zip folder does not inherit permissions are from its parent folder, nor from the files being archived.
(Fixing the permissions manually is not a problem -- only an inconvenience -- but this is repetitive.) I confirmed that the text files, before archiving, have inherited full-control for Everyone from the parent folder.
Specific example:
-- in a folder with inherited full-control for Everyone, I archive text files.
-- I archive the files by selecting a group of them, right-clicking the selection, hovering over "Send to", and selecting "Compressed (zipped) folder".
-- The zip folder is created within the same folder...
but the zip folder does not allow full-control to Everyone.
Why I care:
The parent folder is being backed-up using a bat file that executes ROBOCOPY.
The robocopy fails to backup the zip sub-folders.
I have to edit the permissions on each zip sub-folder after creating it, or set ROBOCOPY parameters to limit retries (in which case zip folders are not backed up).
Is there a simple fix, trick, or setting to make "Send to" / "Compressed (zipped) folder" automatically create the zip folder with inherited permissions?
(Note: this problem mostly affects us on one of our "Server 2008 R2" systems, but I have recreated it in Windows 7.)
(Also: I posted this question first on answers.microsoft.com, but was told to post it here.)
Related question on technet (not yet resolved, as of 9/26/2012) --
"Compressed (zipped) folder option always created locked zip file"
http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/b83cb991-b554-43a0-9baf-b05a711993ae
Doug Ivison

I realise that this is post has been here for a long time but I happened to be researching something similar and think I have somewhat of a solution for you.
Send to compressed (zipped) folder inherites permissions from the temp folder as this is the folder that windows uses to make the zip file.
Try changing the permissions to %USERPROFILE%\AppData\Local\Temp

How do you change the owner of a folder?

Hello,
I'm having a very difficult time finding an answer to this question. I have a brand new xserve (10.5.2) up and running fine with a single web site with wikis and blogs enabled. I can get to the web page and the wikis with no problems.
The problem is, the default folder for the web home page and the wiki information are on the system drive. I need to have those folders on another partition. I created a folder called /Collaboration and one called /Webdocs on the partition on which I need these folders.
When I put a copy of index.html into the webdocs folder, the web site shows up fine in a browser window. Wikis show as being "disabled" though. The folder for the wiki files has me as the owner since I created it. I've read on a few posts in these forums that the owner of that Collaboration folder needs to be "teamserver" however, I am unable to change to that using Get Info, like I could with a Tiger machine.
Could someone please tell me how to do this? Thanks.

I've got a similar problem:
I'm attempting to follow the directions in the Upgrading and Migrating Guide for Leopard. The Mac has two hard drives in it. Batman contains the active server running 10.4.11. Magic is the hard drive that will run 10.5.2.
Since I'm moving from one hard disk to another (as opposed to an entirely different Mac), things ought to be fairly easy. But not for me. ;(
What I'm trying to do: Migrate the mail database. (I have managed to import users and groups; only the mail service will run on this machine.)
Problem: I can't change the owner and group settings on the various files in the var/imap and var/spool/imap folders (for example, so that they are owned by system or _cyrus, with group wheel or mail and everyone set to read only).
The owner and/or group often shows up as unknown (which is to be expected with the migration to a different hard drive). But how can I change these permissions?
Or is there a way to use a command to copy them from one disk to another? I tried ditto, but didn't get the syntax right (the files were copied to the same level as the imap folder rather than within it) and now I have a bunch of files owned by nobody that I can't delete because I can't change the owner.
TIA,
mm

Proper way to make bulk changes the Owner ID, Path and file share credentials for my existing subscriptions, ExtensionSettings

We are going through with an upgrade/migration to SSRS 2012 and moving everything to a different domain. We have about 200 active subscriptions running, the reports are being delivered to a file share. What is the correct way, in bulk, to change
the OwnerId, the Path and the FileShare Username password credentials for these subscriptions? I see these values are being stored in Subscriptions > ExtensionSettings. I see that the file share path and Owner wouldn't be a problem to change,
but since I see the file share credentials are encrypted I would not be able change them directly in ExtensionSettings. Anyone know the proper way to change the Owner ID, Path and file share credentials for my existing subscriptions without having to
change each one of them manually in the report manager?
Note: Reporting Services Native upgrade from SSRS 2005 to SSRS 2012.
Thanks in advance.

Hi Cygnus46,
Based on my understanding, you want to change the Owner ID, Path and file share credentials for all existing subscriptions.
In Reporting Services, the subscription information are stored in the Report Server database. In your scenario, you can go to report server database and run the query to list all the subscriptions, then modify the owner and fileshare paths in the subscriptions
table. For more information, please refer to this article: Tip: Change the Owner of SQL Reporting Services Subscription. If you want to change
the file share credentials for subscriptions, you can run the query provided by
wiperzeus from this similar thread:
Windows File Share Delivery/ SSRS 2008 R2.
If you have any question, please feel free to ask.
Best regards,
Qiuyun Yu
Qiuyun Yu
TechNet Community Support

When upgrading I changed the owner of everything.

When upgrading my Mac Pro (quad core Intel Xeon) I changed the owner name, and subsequently lost 12 years of mail archives. I have accepted that loss as a result of my stupidity. Now here is my question: Is there a way to universally add my new adminitrator (dougjacobson) as owner of all folders, files, apps, etc.? I am the only user on the Mac.
Thanks for any insight into using the command line.
Doug

I don't have time to write something comprehensive and bulletproof, but here goes...
First, make a copy of one of the folders you want to recover, and practice on that. Once you're confident that you know what you're doing, do it on your real data.
The commands that you're looking for are "chown" and "chgrp", which change the owner and UNIX group of the targetted files. You can read about these by typing "man chown" and "man chgrp", or just Google them.
The main option you will provide to these two commands is the -R flag, which means that it will be applied recursively to the contents of a directory, not just to a single file/directory.
eg: "chmod -R jakesan your_mail_folder/"
You may need to prepend the "sudo" command ("man sudo" for more details):
eg: "sudo chmod -R jakesan your_mail_folder/"
Good luck! (sorry, I may not respond to follow-up questions)

Groups missing inherited permissions from parent folder on SMB share on save

If i save a file on a lion share where i have access RW over group permissions, the groups missing inherited permissions on SMB share on save.
File permissions before save:
user: read/write
group: read/write
other: no access
File permissions after save:
user2: read/write (it changed to the actual users who has permission on the Group)
group: no access !!! Why??
other: no access
On Mac OS X 10.6 i was able to force the group permission, from the parent folder.
Everytime i must manualy propagate from the parent folder to fix this !
Any ideas?

I have the same problem. What exactly do you mean by add ACL. I have tried to change the permissions to add the inheritance via ACL, with no joy - so any help you can give would be appreciated. Thank you.

Getting unactivated changes in a domain

I'm trying to use Weblogic JMX APIs to manage domain configuration as documented here. In particular, I'm trying to list any unactivated changes in the domain by accessing 'UnactivatedChanges' attribute of the 'ConfigurationManager' MBean. Here is my code:
MBeanServerConnection conn = m_wlsServer.getConnection();
ObjectName cfm =
            (ObjectName)conn.getAttribute(m_wlsServer.service,
                                          "ConfigurationManager");
return (Object[]) conn.getAttribute(cfm,
                                                  "UnactivatedChanges");
The last statement is intermittently throwing the following exception:
Caused by: weblogic.management.mbeanservers.edit.NotEditorException:
        at weblogic.management.mbeanservers.edit.internal.ConfigurationManagerMBeanImpl.getUnactivatedChanges(ConfigurationManagerMBeanImpl.java:332)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
Caused by: weblogic.management.provider.EditNotEditorException: Not edit lock owner
        at weblogic.management.provider.internal.EditAccessImpl.checkEditLock(EditAccessImpl.java:1573)
        at weblogic.management.provider.internal.EditAccessImpl.getUnactivatedChanges(EditAccessImpl.java:1081)
        at weblogic.management.mbeanservers.edit.internal.ConfigurationManagerMBeanImpl.getUnactivatedChanges(ConfigurationManagerMBeanImpl.java:323)
I'm using the username as 'weblogic' who is the default administrator that is created along with the weblogic installation.
Any ideas of what I'm doing wrong? Could this be a bug?
Thanks,
Venkat.

You need to give more details..
Are you loading data from a flat file..?
If yes, are you giving values DATETO and DATEFROM.
While giving them..Data range should not overlap.
I guess, you missed giving values for DATETO and DATEFROM
For eg:
M_NO M_NAME M_GROUP
M100   X              MG10
M100   Y             MG20.
if we check M_GROUP attribute as Time dependent, then your master data tables looks like below
M_NO DATETO DATEFROM M_NAME M_GROUP
M100    99991231 20080312    X             MG20
M100    200080311 19000101   X             MG10.
So, you have to provide the date ranges..I guess, as per the error msg..it looks you are not provided the date ranges..
Regards

Set-Acl removing inherited permissions

Hi,
I am trying to set permissions on a remote share. However, using Set-Acl removes the inherited permissions from the share.
i.e. F:\SHARE inherits permissions from F:\
Using Set-Acl in any way, removes the permissions inherited from F:\.
i.e. (Get-Acl \\SERVER\SHARE) | Set-Acl \\SERVER\SHARE
After running that command, the inherited permissions from F:\ will no longer be applied to F:\SHARE
Ideas?
Another thread suggested this was a UAC issue. UAC is turned off on both the computer running Set-Acl, and the computer with the share. UAC was turned off by changing the value of EnableLUA from 1 to 0 in "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system".

This is because setting the ACL on the root of a share using the UNC path disables inheritance for that folder. It has nothing to do with UAC and is by design. Try doing it in explorer and you'll get a warning stating just that.
EDIT: To set the permissions remotely in this particular case, you'll need to be an administrator on the remote machine. This allows you to connect via \\SERVER\F$, where you are then free to set permissions on the \\SERVER\F$\SHARE folder without disabling
inheritance.
Best Regards,
Carl S
All code is provided as-is with no guarantees. Always try it out in a test environment before applying it in a production environment.

How do I change the owner of my group chat

I need to change the owner of our chat group (or add more admin to the group) so other users can remove users from the chat group. Currently the only person can remove users from the group is the person who created the group. Any help greatly appreciated.

Try having the chat creator who has the permissions do "/setrole [Skype Name] MASTER" for someone they would like to add as a mod

Set inherited permissions on iLifeAssetManagement?

I have a second user account on my mac that is only used for iCloud syncing for my wife's apple id. In order to consolidate photostream photos I'm going to set up a process to pull new photos out of her photostream folder and import them into my iPhoto library.
But first, I have to alter permissions so I can see her photos from my user account.
I'm using this to change the security settings to allow everyone access and inherit all contents:
sudo chmod -R +a "everyone allow read,write,execute,append,readattr,readextattr,readsecurity,writesecurity,file_inherit,directory_inherit" '/Users/Wife/Library/Application Support/iLifeAssetManagement/assets/sub'
This works for existing photos. The problem is when new photos come in to 'iLifeAssetManagement/assets/sub', they are automatically set where only her user account can see them. I don't know why this would override the settings (to inherit) from the parent folder.
I could add this into a process that does what I want, but I would have to put an admin password in the script.
Does anyone know how to force new photostream photos to obey the parent folder inheritance permissions?
I'm stumped.
Thanks :-)

You might dump Verio, or have their techies reset permissions
as you
require.
"itinko" <[email protected]> wrote in
message
news:erq4ub$k6i$[email protected]..
> We are hosting at Verio and apparently they don't have
file permissions
> on
> their control panel. DW set permissions returns with
error and Verio
> suggests
> we use Frontpage which we don't have and don't want to
pay for. Typical
> FTP
> client using CHMOD command also fails.
>
> Can anyone suggest a workaround for this, perhaps an
open source tool that
> mimics Frontpage?
>
> Thanks much.
>

Windows 7 or Windows Server 2008 R2 domain join displays error "Changing the Primary Domain DNS name of this computer to "" failed...."

Hi,
Windows 7 or Windows Server 2008 R2 domain join displays error "Changing the Primary Domain DNS name of this computer to "" failed...."
DC:windows Server 2008 R2
Domain functional level:Windows Server 2003
When Winxp join domain, have no this error message.
I checked http://support.microsoft.com/kb/2018583?wa=wsignin1.0 does't work.
There have 3 suggestion in this article:
1.The "Disable NetBIOS over TCP/IP" checkbox has been disabled in the IPv4 properties of the computer being joined.
Doesnt's work.
2.Connectivity over UDP port 137 is blocked between client and the helper DC servicing the join operation in the target domain.
On my DC, I run netstat -an, reslut as below:
UDP 192.168.20.3:137 *:*
3.The TCP/IPv4 protocol has been disabled so that the client being joined or the DC in the destination domain targeted by the LDAP BIND is running TCP/IPv6 only.
We are not using IPV6.
This server recently updated from Windows Server 2003 to Windows Server 2008 R2. Before upgrade, when Win7 and Win2008 join this domain, also have the same error message.
Please help to check this issue.
Thank you very much.
BR
Guo YingHui

Hi Guo Ying,
I have faced this critical error which makes over-writes the host names in the domain when you join.
For example: Already you had a host name called as PC.domain.com in the domain.com Domain.
When you try to add the another host name called as PC in the domain.com Domain, it doesn't give you the duplicate name error on the network it does over-write the existing host name called as PC.domain.com & it will add the new host name into the domain.
Host name which got over-written will get removed from the domain. I faced this issue in my project. My DPM host name got removed from the Domain & new host name got joined into the domain which halted my backups for one day.
Final Resolution is as follows:
You need to start the dns console on the DC & drop down the domain name.
Select the _msdcs when you click on _msdcs it will show the Name Server's list on the right hand side.
You need to add the Domain Naming Master under the _msdcs or add all the domain controllers which you had.
After you add the Name server's try joining the PC OR Laptop to the domain which is successfully joins it.
Regards
Anand S
Thanks & Regards Anand Sunka MCSA+CCNA+MCTS

Changing the internal domain to a subdomain -- Help!

Hello, so I have a huge project coming up and i was wondering if someone had some experience on this that could give me some advice.
So, started working on this company that has an internal domain called.. lets say abc.com and external alphabetaghama.org .. the problem we have is that we cannot get certs for our internal domain for public access like our exchange
server fqdn for example is exchange.abc.com ... Someone else owns abc.com which prompted my new boss to fix this and now i have a project to change our internal domain to match our external but I know that the best practice is to have a
subdomain as the internal domain and I think that's the route my boss wants to go with.. which brings me to my question.
What will I have to do to get this accomplished... our external domain name is really just a forward zone and i dont have a forest so does that mean that i will have to build a alphabetaghama.org forest and add a subdomain like corp.alphabetaghama.org
for our internal and then migrate everything over?
We currently have exchange 2007 with 2008R2 DC's.. our new domain would be on 2012R2 DCs with the same exchange server..
Sorry if something doesn't make sense, I'm a little new to a major project like this...

Hi,
This really depends on the requirements. As the Domain restructure is a huge project, we'd better have some experts with good experenses at hand. And if the problem (to get public access) is solved, it is recommended to have a good consideration
if the rebuilding is needed.
Regarding the internal domain name, maybe you want to have a look into the below MS article:
How Domain Rename Works
http://technet.microsoft.com/en-us/library/cc738208(v=WS.10).aspx
For your reference:
ADMT Guide: Migrating and Restructuring Active Directory Domains
http://technet.microsoft.com/en-us/library/cc974332(v=WS.10).aspx
One thing to mind is ADMT tool may cannot
be installed on a Windows Server 2012 DC, so please make sure in the target domain we have a Windows Server 2008 DC to be the ADMT server.
ADMT 3.2 and PES 3.1 installation errors on Windows Server 2012
http://support.microsoft.com/kb/2753560
Hope this may help
Best regards
Michael
If you have any feedback on our support, please click
here.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Error while changing the owner of an object in Discoverer

Hi All,
I have a problem in Discoverer folders.
I have a folder whcih is based on a view in schema in A, now i have created the same view in schema B and want to change the owner of the view in Discoverer to B.
But when i do that it gives me an error as -
'An error occured with the darabse transaction because the underlying object has been changed'
I am not able to understand this.
If anyone can help me this it would be really helpful.
Regards,
Shruti

Well, this is something not talked about in the Administration training class. My hunch is that you are trying to do something that Oracle never intended you to do. I think when you edit the folder and want to change the Owner property, the idea maybe is that you are trying to change the owner on the original table. Here you have said that you recreated the view in schema B (so technically a different table object). But in Discoverer you are still dealing with the view in schema A as the basis for the folder, not the view in schema B. Though I would think if you can see the new owner's name in the database/user list and thus can pick it, it should let you change the owner property, even if that may not be quite what you intended. Discoverer does store things under the cover (such as unique ids), so maybe something is going on that is not visible. My suggestion would be to open up a service request with Oracle support on this. The idea of dropping the folder and then readding it may be okay, but that would be something you would want to test in some kind of test environment and see what happens (not sure what impact that may have on workbooks using the original folder). Of course it may be possible that you have uncovered an Oracle bug.
John Dickey

SSIS Package No longer runs after changing Service to Domain user

Hello,
I changed the SQL Agent/SQL Service owner on our SQL 2008r2 Server and one of the jobs started to fail with the following message:
"     Description: SSIS Error Code DTS_E_OLEDBERROR. An OLE DB error has occurred. Error code: 0x80004005. An OLE DB record is available. Source:
"Microsoft Office Access Database Engine" Hresult: 0x80004005 Description: "Unexpected error from external database driver (????????).". End Error Error: 2014-05-30 14:47:18.68     Code: 0xC020801C
Source: Upload Source - Page1_1$ [1]     Description: SSIS Error Code DTS_E_CANNOTACQUIRECONNECTIONFROMCONNECTIONMANAGER."
The AcquireConnection method call to the connection manager "test.xlsx" failed with error code 0xC0202009. There may be error messages posted before this with more information
on why the AcquireConnection method call failed.
The user running the service has local admin rights on the server and all of the other jobs are still running successfully. I can also export the package and run it without issue. Its only when its ran through a schedule/job agent that it fails. Any tips
would be great as i need to get this running yet today.
Thanks!
Eric

Hi Eric,
According to your description, the issue occurred after the job owner was changed. I suggest that you create a new job to run the package to see if the issue persists. If the issue doesn’t occur in a new job, the issue should be related to the operations
of changing job owner.
If the issue persists in a new job, the error message generallys occurs due to the Microsoft ACE OLE DB Provider 12.0. If you check the “Use 32 bit runtime” option to make the package run in 32-bit runtime mode, make sure the 32-bit Microsoft ACE OLE DB
Provider is installed on the server. If the “Use 32 bit runtime” option is not checked, you need to install the 64-bit Microsoft ACE OLE DB Provider. You can get the appropriate version of Microsoft ACE OLE DB Provider from:
http://www.microsoft.com/en-in/download/details.aspx?id=13255
If the Microsoft ACE OLE DB Provider 12.0 version correctly matches the package runtime mode, try to reinstall the Microsoft ACE OLE DB Provider. Moreover, the AccessDatabaseEngine.exe and AccessDatabaseEngine_x64.exe cannot be installed side by side.
Regards,
Mike Yin
TechNet Community Support

AGPM - Change Archive Owner - Domain Delegation inherited permissions

Similar Messages

Maybe you are looking for