Microsoft Knowledge Base Article 907434 Describes a problem in which changes that you make to the security descriptor on a user object are removed in an hour. This issue occurs when the user account is in a protected group.