title: Active Directory membership permissions Domain ello
body: <p>I need some help understanding the behavior of AD and the security around it.
  In a nutshell I have a requirement to automate just in time elevation to certain privileged groups, where Domain Admins is one of the groups we need to add membership to.
  Here is a summary on the way I set things up
  I created a new group called DomainAdminJit which is a member of &quot;Domain Admins&quot;, I add a service account as a delegate to DomainAdminJit to modify membership where I expect to add users to this group instead of the domain admin group directly, for organization purposes mainly.
  This works fine but a few minutes later all permissions are to the service account are being stripped, researching this turms out to be done because the AdminSDHolder is reverting those permissions.
  My initial reaction was to add the service account with write properties and write permissions to the AdminSDHolder container, but  somehow that doesn't work.
  I do see the service account now at the DomainAdminsJit group however I get insufficient rights when attempting to add a user to the DomainAdminsJit using that service account.</p>
  <p>What am I missing and how do I ensure that service account is always able to add members to a group that is a member of Domain admins and not have the permissions revert?
  Your help would greatly be appreciated</p>
  <p>Thank you</p>