Re: Default Users properties

From: Steven L Umbach (sumbach_at_nospam-ameritech.net)
Date: 01/30/04 

Date: Fri, 30 Jan 2004 22:01:16 GMT

The administrator, domain admins, and enterprise admins have everything but
full control, system has full control, authenticated users has read,
everyone has change password, and if present the pre-2000 group has read.
You can also use the dsacls /s command to reset any object or container back
to default settings as defined in the schema if need be. Be very careful
changing any AD permissions and document/test well as you can prevent users
from changing passwords, prevent administrators from modifying Group Policy,
prevent Group Policy from applying to users, etc. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;281146

"Pat" <htech@hotmail.com> wrote in message
news:vo6l10tdutfvfmhu02u8ftic3c319qhvfh@4ax.com...
> Running W2K with AD, what are the default Security settings for the
> User folder in AD?

Relevant Pages

  • Re: Win 2008 - Error when setting up an authoritative time server
    ... Even domain admins are not having full control by default. ... When an administrator logs on to a computer running Windows Vista or Windows Server 2008, the user is assigned two separate access tokens. ... check out and TEST the GPO, Computer configuration, windows settings, security settings, local policies, security options, "User account control: Behavior of the elevation prompt for administrators in Admin Approval Mode", choose "Elevate without prompting". ...
    (microsoft.public.windows.server.general)
  • Re: Domain Admin .vs Adminstrator Account
    ... THE Administrator account is the initial or default ... > However, the domain admins group is automatically added to the local> administrators group on all domain members, which means that> the domain admins account has full administrative control over all domain> member machines. ... The administrator account on the other hand, isn't as> powerful in this way (just being an administrator of the domain doesn't mean> you can install software on domain members); the administrator account is> much more powerful, as Cary already stated, from a domain administrative> stand point. ...
    (microsoft.public.win2000.active_directory)
  • Re: Parent Control Software
    ... I have heard that the new McAfee Security Suite has Parent Control. ... You can create a very STRONG and COMPLEX administrator password by ... With this account, a child can access anything you ... Probably the most important part is taking GOOD control of the Administrator ...
    (microsoft.public.security)
  • Re: Cant Create User Profiles?
    ... Ensure the "Profile Folder" has the following permissions set: ... Full Control - Administrator ... > | Windows 2000 Server with the latest service packs and patches. ...
    (microsoft.public.win2000.general)
  • Require users to press Ctrl+Alt+Delete Grayed Out
    ... Per the advice of Kelly of Kelly's Korner I ran RegEdit ... I then created a new DWORD value, "DisableCAD"; ... the check box in the user accounts control ... >>as Administrator (although my account, ...
    (microsoft.public.windowsxp.security_admin)