AD Service Administrator Object Protection - Design Scope

Service Administrator Object Protection

Microsoft Windows 2000 AD onwards employs an automated mechanism for enforcing the integrity of the ACL on key service administrator objects. This process ensures accidental or deliberate modification of the access controls on the objects cannot be made. The background process runs on the Primary Domain Controller Emulator in each domain and checks and applies a standard security descriptor on all protected objects. This process ensures that the integrity of the objects cannot be compromised as any change to the ACL of the account is overwritten with a known state.  The process starts 15 minutes after the system starts and then continues to check every 30 minutes after that. The refresh interval is not user configurable.

Object	Scope
Enterprise Admins	Forest
Schema Admins	Forest
Administrators	Domain
Domain Admins	Domain
Server Operators	Domain
Backup Operators	Domain
Administrator	DS Restore Mode
Account Operators	Domain
Print Operators	Domain
Replicator	Domain

The security descriptor template that is applied to these accounts is stored as the security descriptor attribute of the AdminSDHolder object which is stored in the following location:

CN=AdminSDHolder, CN=System, DC=DomainName

The security descriptor on the AdminSDHolder object controls access to the object itself and acts as the master security descriptor to be applied to the service administrative groups and the members to remain as protected. 
Care should be taken when modifying the security descriptor of the AdminSDHolder object as any changes will be cascaded to all objects that are part of the protected object process, namely the objects defined in the above Table

Active Directory Security Group Scope and Membership

Active Directory Security Group Scope and Membership Local Security Groups A Local Security groups’ scope is the machine on which it is located. Local groups in Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows Vista, Windows 7 and Windows 8 are similar to local groups in Windows NT. They can contain user accounts that are local to the computer and user accounts and global groups from their own domain. A local group can be granted permissions to resources only on the computer where it was created. A local security group can be used to assign permissions to local resources on a computer. Domain Controllers do not have local security groups. Domain Local A domain local groups’ scope is a single domain in which the group is created. A domain local group can only be assigned permissions on objects in that domain. A domain local group is ideally used as a resource group for collected together other groups that need the same level of access to an object. This is useful for limiting the number of ACL entries required on an object. Domain Local groups should be used where ever possible for exposing management tasks within the delegation model. When the domain is in mixed mode, domain local groups can contain user accounts and global groups from any trusted domain or forest. When the domain is in native mode, domain local groups can also contain domain local groups from their own domain and universal groups from within any domain in the forest. Note:- Do not use domain local groups to control Read permissions on object attributes that are replicated to the global catalog - since the users has no control over which global catalog server is selected, the results can be unpredictable. Global These groups can contain members only from their own domain but can be granted permissions to resources in any trusting domain. When the domain is in native mode, global groups can contain user accounts and global groups from the same domain. When the domain is in mixed mode, these groups can contain only user accounts. Because global groups have forest wide visibility, they are best used to organize users or groups of users into administrative roles. Universal A Universal groups’ scope is all domains in a forest. A universal group can be used in all trusted domains and can be assigned permissions on all objects in all domains of the same forest. These groups can contain user accounts, global groups, and universal groups from any domain in the current

How can I implement AD delegation with Group Policy

Active directory Delegation with Group Policy:

How can I implement AD delegation with Group Policy

AD based Group Policy is a very useful tool in implementing a delegation model. It provides a number of capabilities that can be used to manage aspects of security across multiple object types and ensures the adherence to a known state. Useful aspects include:

-      User Rights Assignment - This can be used to grant / revoke special abilities required for some management tasks.

-      Restricted Groups – This provides the capability to enforce security group membership. This capability is useful for ensuring a known-state membership of security sensitive groups. It is recommended that this mechanism is used to control the membership of groups such as Enterprise Admins, Schema Admins, and Domain Admins within an environment.

-      File System Permissions – This capability can be used to control the access control lists of NTFS file system objects.

-      Registry – This capability can be used to control access to specific registry keys.

-      Services - This capability can be used to control access to specific services.

All of the above can be assigned in a granular fashion to specific groups of objects depending on the underlying group policy strategy deployed. Indeed, the requirements of the delegation model may drive the group policy design to some degree.

What is DSACLS.EXE how to set ACL of AD objects

DSACLS.EXE

DSACLS is a support tool command line program for manipulating the ACL of AD objects. The tool is useful for batch scripting changes to the security model, which makes it ideal for implementing a delegation model. Care must be taken however, as the tool directly manipulates the underlying security and does not provide ‘safety net’ prompts. The tool assumes the user knows what he / she are doing. The command syntax of the tool is relatively simple but an understanding of AD and the security model is essential. This command-line tool is built into Windows Server 2008/2008 R2/2012/2012 R2 and is available when the Active Directory Domain Services (AD DS) server role installed. The DSACLS command requires elevated privileges. Below command will delegate user “User1” with the permission to delete organizational unit “sales” and its child objects.

Dsacls "ou=sales,dc=sccm,dc=com" /G sccm\User1:DT

Adding Mail Exchange MX Servers records in DNS

MX records identify mail exchange servers for the domain. These servers are responsible for processing or forwarding mail within the domain. When you create an MX record, you must specify a preference number for the mail server. A preference number is a value from 0 to 65,535 that denotes the mail server's priority within the domain. The mail server with the lowest preference number has the highest priority and is the first to receive mail. If mail delivery fails, the mail server with the next lowest preference number is tried.

You create a MX record by doing the following:

1.     In the DNS console, expand the Forward Lookup Zones folder for the server you want to work with.

2.     Right-click the domain you want to update, and then from the pop-up menu, choose New Mail Exchanger. This opens the dialog box shown in below figure.

3.     You can now create a record for the mail server by filling in these fields:

o    Host Or Domain Enter the optional host name.

o    Mail Server Enter the fully qualified host name.

o    Mail Server Priority Enter a preference number for the host from 0 to 65,535.

Mail servers with the lowest preference number have the highest priority.

Tip Assign preference numbers that leave room for growth. For example, use 10 for your highest priority mail server, 20 for the next, and 30 for the one after that.

4.     Click OK.

My Password Keeps getting Locked

 

In my Active Directory My Password Keeps getting locked, How can i troubleshoot ? What could be wrong ?

After 5 unsuccessful login users account will be locked. Usually these incidents resolved by service desk team. Incase the same account is repeatedly locking out then incident will be transferred to Directory services to check the caller machine (computer name) causing account lockout. There so many ways to find out the lockout status. In my LAB environment I am using change auditor. The console is installed in Test Server.

 

1.1.1 Steps to know the status of account lockout:

Open Change Auditor client in Test Server

1.     As per below screen shot go to shared –Built-in-All Events. In Right had side you will get all the events. Copy the “All Account Lockout Events” paste it to private search folder so that the searches we are doing will be only in our profile.

 

2.     Now go private search folder  and hit on “All account Lockout Events”.

3.     By default change auditor will open 7days account lock out users data. We can use tabs to filter the data. Tabs  are very much self explanative. Eg: Who,What,when

4.     After receiving the search results it will show where and when account is locked out.

What are the Default Domain Policy

Controlled by Default Domain Policy	Settings
Account Policies
Account Lockout Threshold.	5
Account Lockout Duration.	0
Reset Account Lockout Counter After.	30
Maximum Password Age.	60 Days
Minimum Password Age.	1 Day
Minimum Password Length	7 Characters
Passwords Must Meet Complexity Requirements	Enabled
Enforce Password History.	6 passwords remembered
Store Passwords Using Reversible Encryption for All Users in the Domain	Disabled
Change System Time	LOCAL Service, Administrators, Power Users

Above are the default Domain Policy settings .

AD schema Extension for SCCM 2007 /2012

When extended Active Directory (AD) 14 attributes will be created

CN=mS-SMS-Assignment-Site-Code

CN=mS-SMS-Capabilities

CN=MS-SMS-Default-MP

CN=mS-SMS-Device-Management-Point

CN=mS-SMS-Health-State

CN=MS-SMS-MP-Address

CN=MS-SMS-MP-Name

CN=MS-SMS-Ranged-IP-High

CN=MS-SMS-Ranged-IP-Low

CN=MS-SMS-Roaming-Boundaries

CN=MS-SMS-Site-Boundaries

CN=MS-SMS-Site-Code

CN=mS-SMS-Source-Forest

CN=mS-SMS-Version

When extended Active Directory (AD) 4 Classes will be created

CN=MS-SMS-Management-Point
CN=MS-SMS-Roaming-Boundary-Range
CN=MS-SMS-Server-Locator-Point
CN=MS-SMS-Site

You can find more information https://technet.microsoft.com/en-us/library/gg712272.aspx