The Object Permission Structure In Active Directory

By Author: Shirley Green
Total Articles: 129
Comment this article

The object permission structure for Active Directory has many similarities with that of the MCSE 2003 exams file system. Objects are arranged in a hierarchical structure, and permission inheritance can be managed to ensure the propagation of permissions throughout a section of the structure or to prevent inheritance by sensitive objects. Like files, folders, and registry keys, Active Directory objects have their own unique permission sets. There are two differences between Active Directory objects and the other objects that can be protected by permissions:
There are many Active Directory object types, and each type has some permissions common with all other object types and its own set of unique permissions.
To the Active Directory, all activity is seen as a matter of access, and all management over this activity is seen as access control. It's as if rights have become permissions. Some permissions available for Active Directory objects can be leveraged to provide granular control over whole categories or divisions of the Active Directory infrastructure.

The permissions ...
... that are available for each object in Active Directory and their default settings are defined in the free Microsoft certification exam questions schema in the Active Directory Schema. It would be impossible to list all of them in this book; indeed, there does not seem to be a publicly available comprehensive list of all possible permissions. Nor is there any guide that might help you determine the exact impact of every possible set of permissions. And there might never be. However, you can investigate and learn about the major permission sets and then use them to gain a security advantage.

You can also plan and undertake management of Active Directory objects by using the permissions that you do understand. You can delegate administration of Active Directory objects by assigning permissions at the container or object level. However, best practices dictate that you should do so at the container level in most cases. For example, for delegation of authority at the object level look at the discussion on securing a Certification Authority in Chapter 2. In that case, you assign administration of a single CA by assigning permissions on that CA object. For an example of delegating authority at the container level, see the following free practice exams for MCTS discussion of managing OUs.