Protection Operation

Every object in the protected set is examined at least once every 120 minutes, every 60 minutes by default, at domain d's PDC FSMO role owner. For any object o where o!nTSecurityDescriptor ≠ AdminSDHolder!nTSecurityDescriptor an originating update is performed replacing o!nTSecurityDescriptor with the value of AdminSDHolder!nTSecurityDescriptor. Other replicas of domain d see the effects of this operation after a delay due to replication.