What you’re seeing
- Helpdesk staff get 'Access is denied' or 'Insufficient access rights to perform the operation' on a handful of users.
- The same person can reset passwords for most accounts without any trouble.
- A password reset or sync tool fails only for certain users, often ones who were once admins.
- Changes to these accounts appear to save and then quietly revert about an hour later.
- The affected accounts show an 'adminCount' value of 1 in their attributes.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The accounts were once members of a protected group such as Domain Admins, so AD stripped inherited permissions.
- A background process called SDProp resets these accounts to the AdminSDHolder permissions every hour.
- Removing someone from an admin group doesn't automatically restore their normal permissions.
- Delegated helpdesk rights were granted on OUs, and they don't apply to accounts that block inheritance.
- Old service accounts or former IT staff still sit in protected groups.
Why it matters
These errors frustrate helpdesk staff and leave certain users waiting for a senior admin to step in for simple password resets. More seriously, they often reveal former admin accounts that still have elevated rights, or service accounts with too much access. Attackers target exactly those accounts. Leaving the situation alone means routine support stays slow and hidden privileged access stays in place.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Why can we manage most users but not these few?
Accounts that were ever in a protected admin group get special permissions that block normal delegation. That protection stays until it's deliberately cleaned up.
Is this a security problem?
It can point to one. Accounts with lingering admin status or stale membership in protected groups deserve a review.
Can AskTechGurus clean this up?
Yes. A certified US engineer reviews the affected accounts and admin groups over a secure remote session. Pricing starts at $99, and you pay only once it's resolved.