Helpdesk was delegated ‘Reset password’ on the ‘Users’ OU. They can reset most users’ passwords but cannot reset the password for a user who is a member of Domain Admins, even though that user account resides in the same OU. You need to allow the Helpdesk group to reset passwords for protected accounts while keeping AdminSDHolder protections in place. What should you do?

The correct answer is to modify the DACL on CN=AdminSDHolder,CN=System,<domain DN to grant the Helpdesk group the ‘Reset password’ permission, then wait for SDProp to apply. AdminSDHolder protects highly privileged accounts by periodically overwriting their permissions with those defined on the AdminSDHolder object. To grant Helpdesk the ability to reset passwords for these accounts while maintaining AdminSDHolder protection, you must modify AdminSDHolder itself. SDProp (Security Descriptor Propagator) is the process that applies these permissions. Enabling permission inheritance on the protected user object is incorrect because AdminSDHolder would overwrite those changes. Moving the user to a different OU is incorrect as AdminSDHolder protection is based on group membership, not OU location. Running gpupdate /force is irrelevant as this is a directory permission issue, not a Group Policy issue. Clearing the adminCount attribute is incorrect as it removes the protection, which contradicts the requirement to keep AdminSDHolder protections in place.