Article ID: 318180 - View products that this article applies to.
This article was previously published under Q318180
An Active Directory domain controller that holds the primary domain controller (PDC) operations master role (also known as the flexible single master operations role or the FSMO role) runs a thread every hour to check the access control lists (ACLs) on the following groups and all of the member objects of these groups:
This article describes how the AdminSDHolder thread affects transitive members of distribution groups. For additional information about the AdminSDHolder thread, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/232199/ )Description and update of Active Directory AdminSDHolder object
Membership of a distribution group does not normally have any security significance. For example, if UserA is a member of Distribution GroupA and Distribution GroupA is a member of the Domain Admins group, UserA is not a member of the Domain Admins group if the user is logged on to the computer. The distribution group blocks security group membership. However, the enumeration algorithm that is used by the AdminSDHolder thread is fast and simple and it includes UserA during the transitive iteration of the Domain Admins group.
You can change groups from being a distribution group to a security group; therefore, the enumeration algorithm that is used by the AdminSDHolder thread ensures that all transitive members are covered in both cases. Do not make distribution groups members of security groups, if possible. You do not experience unexpected behavior after you change the group from a distribution group to a security group if you do not make distribution groups members of security groups. A user that is covered by the enumeration algorithm that is used by the AdminSDHolder thread has an AdminCount attribute that has a value that is greater than or equal to 1.
Article ID: 318180 - Last Review: October 30, 2006 - Revision: 4.1