This issue occurs if a user is a member of more than one Active Directory group and one of these groups is configured with a read-only role on an object (for example, an ESXi host). In this case, the read-only permission is applied to that object despite the presence of an administrators permission that has been propagated from a higher level.
Note: If the read only permission is applied at the highest level, administrators or the
[email protected] account may not have the access rights to remove this permission.