Re: AdminSDHolder

From: Laura A. Robinson (firstinitiallastname@technologist.com)
Date: 11/06/02 

From: "Laura A. Robinson" <firstinitiallastname@technologist.com>
Date: Wed, 6 Nov 2002 02:49:31 -0500

circa Tue, 5 Nov 2002 19:55:43 -0500, in
microsoft.public.win2000.security, Brian Mulrooney
(xaosflux@bellsouth.net) said,
> What are the effects of modifying the AdminSDHolder settings on my domain?
> I would like to set certain permissions on some Enterprise Administrator
> Accounts (such as removing Domain Admin security access) but AdminSDHolder
> keeps resetig the permissions.
>
Which is what it's designed to do. Instead of looking at modifying
AdminSDHolder, you should probably be looking at not using the
accounts in question and requiring smartcard authentication for those
accounts.

Laura 

-- 
Time flies like an arrow; fruit flies like a banana.
-Groucho Marx

Relevant Pages

  • Re: Prevent changes to Administrator password
    ... The group is used in ACEs on the AdminSDHolder ACL. ... recommend modifying the ACL on the group itself. ... This has always been a best practice for assigning permissions. ...
    (microsoft.public.windows.server.active_directory)
  • Re: AD User Objects not retaining security
    ... It is a good bet that you are running up against "adminsdholder". ... Some accounts are "protected". ... placeholder object in AD that has a set of permissions on it. ... new security was added to the security tab of an AD user object, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Prevent changes to Administrator password
    ... you need to understand that permissions on the RootDomain\Administrator account are applied via AdminSDHolder so you need to modify the permissions on the AdminSDHolder object in the root domain. ... If you are just having him create a group and modify it using ACLs then if anything goes wrong it can easily be undone by removing the admins from the new group, ... Deny the Restricted Admins group the Write Permissions permission ...
    (microsoft.public.windows.server.active_directory)
  • Re: Prevent changes to Administrator password
    ... By adding the Deny Write Permissions ACE, these individuals will not have the ... permission to modify the ACL on AdminSDHolder. ... modify the permissions on the AdminSDHolder object in the root domain. ... refer to it as "Restricted Admins") ...
    (microsoft.public.windows.server.active_directory)
  • Re: Default groups and security permissions
    ... requirement of delegating permissions to help desk on DCs for operations only ... the Domain Admins, Enterprise Admins, and Schema Admins to prevent a member ... If you try to change it, the AdminSDHolder function will revert it back. ... Microsoft MVP - Directory Services ...
    (microsoft.public.windows.server.active_directory)