3

I am in the middle of creating a multi-server farm in a very restrictive security environment. All servers are Windows 2008 R2 Enterprise.

I was following one of the security guides which involved removing permissions to the AD schema via the schema management tool. Either due to errors in the guide and/or errors by me I can no longer connect to AD via any of the normal tools (Active Directory Sites and Services, Users and Computers, etc). Attempting to connect via ADSI edit causes mmc to crash unless I specify "Schema" as the well-known naming context.

I have tried using both my enterprise admin and domain admin account.

Recreating the domain is far from ideal because I've already installed SQL and SharePoint. Thankfully this system is not in production.

Is it possible to somehow add my rights back?

EDIT: I do not have a backup of AD. I should note I am primarily a developer and not necessarily competent at network or AD administration.

Improve this question
4
  • what security guide told you to change schema perms?
    – Jim B
    Dec 14, 2011 at 21:25
  • I'd rather not say. Let's just say it's distributed by a big organization with stringent security requirements.
    – Chloraphil
    Dec 14, 2011 at 21:34
  • 1
    I'd sy they don't know what they are talking about. I'm pretty confident that changing the default permissions puts you in an unsupported state. see technet.microsoft.com/en-us/library/cc786285(WS.10).aspx. Most of the AD changes I've ever heard proposed have the net effect of reducing security rather than increasing security.
    – Jim B
    Dec 15, 2011 at 2:43
  • I am no fan of most of their policies for sure.
    – Chloraphil
    Dec 15, 2011 at 11:59

2 Answers 2

Reset to default
4

The easiest way would be to restore AD. To you have a backup of AD from before the problem started?

Improve this answer
2
  • Of course not, that would be too easy :)
    – Chloraphil
    Dec 14, 2011 at 21:31
  • Pretty sure you already know the answer then. The upside is that SQL doesn't really need to be reinstalled after you rebuild AD. Sharepoint on the other hand probably will need to be.
    – mrdenny
    Dec 15, 2011 at 3:27
0

No its not possible to add your rights back as I suspect you didn't remove your rights at all but likely removed the ability of AD to actually utilize those rights. As a best practice there are no known circumstances that would "enhance" security by playing with the permissions in the schema. Generally speaking, any changes you make in that regard will likely have the effect of forcing you to decrease the security on existing groups in order to maintain functionality.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .