How to add Send As permission to Active Directory Distribution List that was once (or still is) a member of a protected group

Published: 13/11/2023

Applies to: Cayosoft Administrator 10.3 or later.

Summary: This article contains step-by-step instructions on adding Send As permission to the Active Directory Distribution List, which was once (or still is) a protected group member.

---

Issue

If you add a user as a SendAs delegate to a Distribution List that was once (or still is) a member of a protected group you will get this error:
Active Directory operation failed on <computer.domain.com>. This error is not retriable. Additional information: Access is denied.
Active directory response: 00000005: SecErr: DSID-03152DB2, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0.

Overview

If a user or a group is a member of an Active Directory protected group then when the SDProp process runs every hour it changes this user or group:

1. adminCount attribute is set to 1.
2. In Access Control List inheritance gets disabled.

After that, it is impossible to add a user as a SendAs delegate to a Distribution List using AD native tools or the Cayosoft Web Portal.

 

Resolution

Remove the Distribution List from the protected group, clear the adminCount attribute and restore defaults for Advanced Security Settings.

1. In ADUC open Distribution List Properties > Member Of.
2. Remove the Distribution List from protected groups.
3. In ADUC open Distribution List Properties > Attribute Editor.
4. Double-click the adminCount attribute, and clear it.
5. Save changes.
6. Open Distribution List Properties > Security > Advanced.
7. On Advanced Security Settings click Restore Defaults.
8. Save changes.

Add Send As permission manually in ADUC.

1. In ADUC open Distribution List Properties > Security > Advanced.
2. Click Add.
3. Click Select Principal and specify the user to add Send As permission.
4. Scroll down the Permissions and Properties list and click Clear All.
5. Go back to the Permissions list and check Send As.
6. Click OK.
7. Save changes.