Domain Users Group is a Protected Group on the Domain

Question

I'm having an issue where I set some permissions for a particular users mailbox, but when I come back later the permissions later they have been removed. I have done some digging around and I believe the issue is a result of the Domain Users group being
protected, which has led me to the AdminSDHolder object in the System OU. Does anyone know if it possible to amend the the security permissions, so that the group is no longer protected as it is causing some major issues for me.
Any suggestions would be appreciated
Thanks in Advance

Answer 1

I just want to add to make sure that the user is not part of another group that may be nested in another group that is protected.
I had that issue with a customer, a police dept, after I migrated them to Exchange 2010 when some, but not all users, had issues with their mobile devices accessing Exchange ActiveSync. I found it was previously created users and
not new users, that had the problem. They had a number of users in administrative groups when they had one server that was a DC (previously SBS), and everyone in the organization had access to it, which required users to have administrative
rights, at least that's how they did it back then by the previous administrator, to provide them local logon rights. 
With the help of a tool from Joe Richards, I had to hunt down each nested administrative group the users were in to remove them or change the AdminCount attribute to 0 before setting to allow  inheritance otherwise it would set itself back when
AdminSDHolder runs every hour.
This was all discussed in the following TechNet thread:
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/269e0ab2-6e65-4001-abcb-3c89f6f938fd/issues-with-adminsdholder?forum=winserverDS
Also, take a look at this PW script that is supposed to look for all of that, at least that was my last discussion with the author mentioning that each group that a user is part of must be checked, when he posted the script to the ADDS group
in FB (https://www.facebook.com/groups/ADDSForum/):
Exchange Checkbox of Doom
http://www.dexterposh.com/2014/12/powershell-exchange-checkbox-of-doom.html
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.