-1

I'm trying to create a user in AD which is undeletable, unmodifiable even by Administrators, Domain Admins.

Is there any problem that might occur if I delete the Full control permission on the user object for Administrators, Domain Admins groups?

I suppose, it would result that the user can only be edited by itself.

Improve this question
1
  • I believe that this would depend on what directory you are doing this to. Is it the windows directory? If it is, then that would not be a great idea. Please add more information on what you are trying to accomplish and perhaps someone will give you a best practice to assist you.
    – Citizen
    Jul 9, 2016 at 1:35

1 Answer 1

Reset to default
1

No, nothing unexpected will happen, since the system uses the SYSTEM principal and you aren't planning to delete that.

However, what you are planning to do won't stop an administrator from modifying or removing the object. Administrators always have the SeTakeOwnershipPrivilege privilege, which allows them to set the owner of any object to themselves (or a group to which they belong). The owner of an object change the access list arbitrarily, e.g. to remove a deny entry or allow oneself Full Control. Therefore, a determined admin would do something like this:

  1. Take ownership of the object
  2. Add those access rules back with Full Control
  3. Access or demolish the object as normal

You may need to enable View → Advanced Features in Active Directory Users and Computers before you're able to see the Security tab on AD objects.

Administrators can do anything.

Improve this answer
2
  • So the best way to avoid it would be to delegate control and demote users who might want to revoke admin rights?
    – P Molnar
    Jul 8, 2016 at 21:15
  • 2
    @PatrickMol The most important thing is that you only make trustworthy people admins. Domain administrators can literally do anything imaginable to your domain, and if you can't trust them as people, you're completely hosed from the start.
    – Ben N
    Jul 8, 2016 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .