Re: Default Users properties

From: Steven L Umbach (sumbach_at_nospam-ameritech.net)
Date: 01/30/04 

Date: Fri, 30 Jan 2004 22:01:16 GMT

The administrator, domain admins, and enterprise admins have everything but
full control, system has full control, authenticated users has read,
everyone has change password, and if present the pre-2000 group has read.
You can also use the dsacls /s command to reset any object or container back
to default settings as defined in the schema if need be. Be very careful
changing any AD permissions and document/test well as you can prevent users
from changing passwords, prevent administrators from modifying Group Policy,
prevent Group Policy from applying to users, etc. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;281146

"Pat" <htech@hotmail.com> wrote in message
news:vo6l10tdutfvfmhu02u8ftic3c319qhvfh@4ax.com...
> Running W2K with AD, what are the default Security settings for the
> User folder in AD?

Relevant Pages

  • Re: Domain Admin .vs Adminstrator Account
    ... THE Administrator account is the initial or default ... > However, the domain admins group is automatically added to the local> administrators group on all domain members, which means that> the domain admins account has full administrative control over all domain> member machines. ... The administrator account on the other hand, isn't as> powerful in this way (just being an administrator of the domain doesn't mean> you can install software on domain members); the administrator account is> much more powerful, as Cary already stated, from a domain administrative> stand point. ...
    (microsoft.public.win2000.active_directory)
  • Re: Parent Control Software
    ... I have heard that the new McAfee Security Suite has Parent Control. ... You can create a very STRONG and COMPLEX administrator password by ... With this account, a child can access anything you ... Probably the most important part is taking GOOD control of the Administrator ...
    (microsoft.public.security)
  • Re: Cant Create User Profiles?
    ... Ensure the "Profile Folder" has the following permissions set: ... Full Control - Administrator ... > | Windows 2000 Server with the latest service packs and patches. ...
    (microsoft.public.win2000.general)
  • Require users to press Ctrl+Alt+Delete Grayed Out
    ... Per the advice of Kelly of Kelly's Korner I ran RegEdit ... I then created a new DWORD value, "DisableCAD"; ... the check box in the user accounts control ... >>as Administrator (although my account, ...
    (microsoft.public.windowsxp.security_admin)
  • RE: software to control domain administrators
    ... "Does anyone know any software to control, audit, or restrict access or privileges to domain administrators." ... I will restate my mantra differently, If you can not trust someone to be in a position of complete un-adulterated control of your network, then they should not be in that position. ... >(assuming we are talking about NT/AD Domain Admins) ...
    (Security-Basics)