Simple definition
SDProp is an Active Directory process that helps maintain security permissions on protected administrative accounts and groups.
Technical definition
SDProp periodically checks protected objects and applies security descriptors derived from the AdminSDHolder object, potentially replacing manual permission changes and affecting inheritance.
What is SDProp used for?
Maintain consistent protection of sensitive administrative accounts and groups.
Practical example
If an administrator manually changes permissions on a protected Domain Admin account, SDProp may later restore the configured protected permissions.
Common problems
- ACL that seems to be coming back on its own
- adminCount uncleaned
- Heritage disabled
Related terms
To be noted: precise behaviors and commands may vary depending on the versions, products and architectures.