We’ve had one of our AD Domain Controllers reporting that it didn’t have the SACL right. This was logged constantly on event ID 2080. We tried nearly everything but without success. This morning I came up with a solution to fix it, while trying to desperately find the ntSecurityDescriptor property in ADSI Edit and other places. Well, it’s more simple than that!
On whatever DC, fire up Active Directory Users & Computers, click on the View menu and select Advanced Features. Then browse to Domain Controllers OU, right click on the DC which misses the SACL right and select Properties. Click on the Security tab and select Advanced. Be patient… then on the Permissions tab, click on Add … Select the Exchange Servers security group and click on OK. You will see a dialog with two tabs: Object and Properties. Select Properties. Then scroll down until you find Read nTSecurityDescriptor. Check Allow, click on OK as much as needed to close the window. Then check your event log after a while. Your DC should now report that it has the SACL right. 
5 comments
Comments feed for this article
April 15, 2009 at 11:51 am
David
…looked promising, but: I don’t find the nTSecurityDescriptor there…
(…added notify me checkbox …)
April 23, 2009 at 9:57 am
Max
Hi David, make sure you look for “Read ntSecurityDescriptor” (not ntSecurityDescriptor)
Hopefully it’ll work!! Fingers crossed!
Max
October 7, 2009 at 10:32 pm
Terry
I can’t find the Read ntSecurityDescriptor either?
I am trying to add it to our Win2K8 DC.
October 8, 2009 at 7:54 am
Max
Hi Terry, I just checked on a W2K8 SP1 DC (Test Environment) and I can’t find the Read ntSecurityDescriptor in Advanced/Permissions/Edit/Properties (NOT the Object tab). This is a standard DC which had not its AD Schema prepared/extended for Exchange Server 2007. Please let me know
November 2, 2009 at 2:41 pm
Kobus
On W2K8, it seems that you need to use ADSIEdit.msc and not ADUC snapin.
Go to Start > Run > CMD > ADSIEdit.msc
Domain -> Domain Controller OU
Right click on Domain Controller OU and select Properties.
Security tab and select Advanced.
Permissions tab, click on Add Exchange Servers security group, click on OK
Select Properties. Find Read nTSecurityDescriptor Check Mark on Allow
Click OK until everything closed.