In Microsoft Dynamics CRM 4.0, a user who has the Assign Role privilege in a child business unit can unexpectedly assign the System Administrator role.
This problem occurs because the System Administrator role is automatically cascaded down to all child business units. Additionally, the System Administrator role cannot be changed.
This problem is fixed in the latest cumulative update rollup for Microsoft Dynamics CRM 4.0. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
Microsoft Dynamics CRM 4.0 updates and hotfixes
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
Description of the standard terminology that is used to describe Microsoft software updates
For more information about Microsoft Dynamics CRM software hotfix and update package terminology, click the following article number to view the article in the Microsoft Knowledge Base:
Microsoft Business Solutions CRM software hotfix and update package naming standards
This hotfix prevents users who have a lesser privilege depth for a specific privilege to assign themselves or another user a role that contains the same specific privilege but at a greater depth.