Certain groups within Active Directory are considered protected groups and are protected by AdminSDHolder. When a user becomes a member of a protected group it will no longer inherit permissions from its parent object in AD (usually an OU). This can mess up any carefully laid permission delegations you may have configured. Much more on AdminSDHolder here As an AD admin you may find that if you have been delegated permissions to , say, reset passwords of all users in OU you could come across a user who’s password you can’t reset.