Administering Active Directory Objects

By Author: smileyi
Total Articles: 31
Comment this article

Controlling Access to Active Directory Objects
Windows MCITP Exam uses an object-based security model to implement access control for all Active Directory objects. This security model is similar to the one used to imple?ment NTFS file system security. Every Active Directory object has a security descriptor that defines who has permission to gain access to the object and what type of access is allowed. Windows Server 2003 uses these security descriptors to control access to objects. This lesson explains how to set permissions for Active Directory objects.
After this lesson, you will be able to
View and assign standard permissions for an object
View, assign, and edit special permissions for an object
View effective permissions for an object
Set inheritance for a standard or a special permission
Remove a security principal and its permission
Remove special permissions for an object
Transfer ownership of an object

Understanding Access Control
To control access to Active Directory objects, you grant or deny permissions to ...
... security principals. A permission is the authority to perform an operation or a set of operations on an object and is granted or denied by the certification provider. A security principal is a user, group, computer, or service that is assigned a unique security identifier (SID). A SID uniquely identifies the user, group, computer, or service in the enterprise and is used to manage security principals. As an administrator, it is your responsibility to man?age permissions for security principals. Recall from the discussion in Chapter 8 that OUs are not security principals; therefore, you cannot assign access permissions to OUs. You can set access permissions only on drives formatted to use NTFS.

Off the Record Whoami is a command line utility that displays information about the cur?rently logged on user. You can use this utility to learn about a specific user account before you begin to troubleshoot a resource access problem. The Whoami /all command can be used to the view the SID, group memberships, and specific permissions of a user account. Whoami is included in Windows Server 2003. Although the utility is not available in the default installations of Windows 2000 or Microsoft Windows XF? you can install it from the free certification exam questions for each of those products.