Best Practices for Delegating Active Directory Administration Whitepaper
Contents ii
Introduction 1
Abstract 1
Scope 1
Intended Audience 1
Chapter 1: Delegation of Administration Overview 4
Business Case for Delegating Administration 4
Benefits of Delegation 5
Delegation at Work 6
Active Directory Management 8
Creating a Successful Active Directory Delegation Model 11
Chapter 2: How Delegation Works in Active Directory 18
Overview 18
Active Directory Administrative Tasks 20
Active Directory Logical Structure and Data Storage 21
Delegation and Access Control 25
Chapter 3: Delegating Service Management 46
Level-of-Privilege Considerations in Delegating Service Management 47
Recommended Approach to Service Management 48
Service Management Overview 49
Creating a Service Management Delegation Model 70
Implementing the Service Management Delegation Model 72
Maintaining the Service Management Delegation Model 75
Chapter 4: Delegating Data Management 78
Recommended Approach to Data Management 78
Understanding Data Management 79
Determining Data Management Stakeholder Needs 85
Creating the Data Management Delegation Model 86
Implementing Your Data Management Delegation Model 103
Maintaining Your Data Management Delegation Model 118
Case Study: A Delegation Scenario 123
Company Overview 123
Active Directory Infrastructure 125
Managing Contoso’s Active Directory Environment 129
Best Practices for Delegating Active Directory Administration Appendices
Here are the contents:
Appendix A: Active Directory Administrative Tasks 1
Appendix B: Default Active Directory Security Groups 43
Appendix C: Active Directory Standard Permissions 65
Appendix D: Active Directory Extended Rights 67
Appendix E: Active Directory Property Sets 87
Appendix F: Logon Rights and Privileges 97
Appendix G: Active Directory Delegation Tools 107
Appendix H: Active Directory Display Name Mappings 125
Appendix I: Default Container Hierarchy for Active Directory Partitions 173
Appendix J: Default Owners of Active Directory Objects 177
Appendix K: Default Settings in the Master Security Descriptor of the AdminSDHolder Object 179
Appendix L: Implementing Service Management Delegation Roles 185
Appendix M: Service Management Delegation Role Definitions 197
Appendix N: Default Active Directory Service Administrator Groups 203
Appendix O: Active Directory Delegation Wizard File 205
New Group Policy FAQ
Security at Microsoft
NetPro Ships Directory Lockdown 3.0
monitoring and intrusion detection solution
VBScript or Perl?
MS KB Article of the Week: 322692
Relevant AD Cookbook Recipes:
2.12, 2.13, 2.14
Moving users across domains requires targeting the RID Master
Here is example code.
Relevant AD Cookbook Recipes:
4.18
Coming soon: AD Delegation of Control Whitepaper
Tool of the Week: redircmp.exe
Type of tool:
Command-line
Where to find it:
%SystemRoot%\System32 on Windows Server 2003
Example:
c:\> redircmp "ou=Rallencorp Computers,dc=rallencorp,dc=com"
Relevant Active Directory Cookbook recipes:
8.12
News: Upgrade to Windows Server 2003 or wait?
Why? Because it is pretty painless process. Fortunately, you can migrate at your own pace. Sure you have to update the schema, but that is what an extensible schema is for. There are a lot of new tools and features (some documented, some not) that can help out with day-to-day management of AD. If you can use your same hardware, then it is just a matter of adding to the workload of your already overburdened AD staff :-)
Directory Experts Conference Spring 2004
Disabling ALL anonymous access to AD
This brings up an interesting question. Does allowing anonyous access to the RootDSE present a security risk? In my opinion, is could depending on the environment. If I had access to a company's intranet where AD was running, all I'd need is the name of a single AD domain controller and I could tell you a bit about the forest structure, whether they were running W2K or W2K3, and various other tidbits. I may even be able to map out the entire forest if I could figure out server naming conventions. I don't think this is so important when we talk about intranets, which are typically semi-secured, but the Root DSE would be a treasure chest of information if you are running AD in an outward facing role.
Relevant AD Cookbook Recipes:
4.1. Viewing the RootDSE
14.3. Enabling anonymous LDAP access
New AD Tool: DSREVOKE.EXE
Microsoft created this tool in response to repeated complaints from customers about the lack of an "undo" option for the Delegation of Control wizard. While dsrevoke doesn't quite fit that bill, it can help (using the /remove option).
Here is the complete syntax for the command:
Usage: dsrevoke /report|/remove [/domain:
[/password:
/report: Only reports the ACEs that have been set for the given
principal on all domain and OU objects under root
/remove: Reports and then removes (after confirmation) the aces
for the given principal
/domain: Dns OR Netbios name of domain
(must be specified when
than default or if alternate credentials are provided)
/username: Username if alternate credentials must be specified
/password: * will prompt for password
/root: Root OU to start search for ACEs. If not specified will
default to the specified domain's default naming context (The
root domain or OU must be specified using x500 format; if the
dn must include spaces enclose the option in quotes,e.g. "/root:..")
< securityprincipal > : Domain\User or Domain\Group for the security
principal being looked up
Welcome to the Active Directory Cookbook blog!
