SSO Administrator permissions inadvertently changed

[renright]

I am a VCI and one of the students in a vSphere 7.0 class changed to SSO Administrator account (administrator@vsphere.local) so that he can no longer and or modify permissions.  Is there any way to back out of that? All the global permissions are grayed out. 

[pdirmann01]

I'm assuming that you don't happen to have any other accounts that were created and assigned Administrator privileges, correct?

[renright]

There are no other accounts with administrative privileges. I was always under the impression that an administrator was blocked from reducing their privileges while they were logged in. Guess I was wrong.

[Ajay1988]

Ahh . This is messy. Try the below .

Please have necessary backups and snapshots before. 

Connect to jxplorer using  https://kb.vmware.com/s/article/2146046

Follow below image.

They should be part of all the below groups highlighted even .