Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am in the middle of creating a multi-server farm in a very restrictive security environment. All servers are Windows 2008 R2 Enterprise.

I was following one of the security guides which involved removing permissions to the AD schema via the schema management tool. Either due to errors in the guide and/or errors by me I can no longer connect to AD via any of the normal tools (Active Directory Sites and Services, Users and Computers, etc). Attempting to connect via ADSI edit causes mmc to crash unless I specify "Schema" as the well-known naming context.

I have tried using both my enterprise admin and domain admin account.

Recreating the domain is far from ideal because I've already installed SQL and SharePoint. Thankfully this system is not in production.

Is it possible to somehow add my rights back?

EDIT: I do not have a backup of AD. I should note I am primarily a developer and not necessarily competent at network or AD administration.

share|improve this question
what security guide told you to change schema perms? – Jim B Dec 14 '11 at 21:25
I'd rather not say. Let's just say it's distributed by a big organization with stringent security requirements. – Chloraphil Dec 14 '11 at 21:34
I'd sy they don't know what they are talking about. I'm pretty confident that changing the default permissions puts you in an unsupported state. see Most of the AD changes I've ever heard proposed have the net effect of reducing security rather than increasing security. – Jim B Dec 15 '11 at 2:43
I am no fan of most of their policies for sure. – Chloraphil Dec 15 '11 at 11:59

The easiest way would be to restore AD. To you have a backup of AD from before the problem started?

share|improve this answer
Of course not, that would be too easy :) – Chloraphil Dec 14 '11 at 21:31
Pretty sure you already know the answer then. The upside is that SQL doesn't really need to be reinstalled after you rebuild AD. Sharepoint on the other hand probably will need to be. – mrdenny Dec 15 '11 at 3:27

No its not possible to add your rights back as I suspect you didn't remove your rights at all but likely removed the ability of AD to actually utilize those rights. As a best practice there are no known circumstances that would "enhance" security by playing with the permissions in the schema. Generally speaking, any changes you make in that regard will likely have the effect of forcing you to decrease the security on existing groups in order to maintain functionality.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.