0

If I set a "Deny" type permission to the "Everyone" well-known principal, in the "Write userAccountControl" property of an AD Object, like a User, it works kind of the same as the "Protect the object from accidental deletion", but protecting from accidental disabling, right? Is it viable in case of some VIP accounts or something like that, or it's a bad practice?

Improve this question
5
  • 2
    Well that would be a horrible idea, because "Everyone" includes... well, everyone... and denies always take precendence... so everyone would be denied the ability to modify that attribute, including Domain Admins, Account Operators, etc.
    – Ryan Ries
    Mar 30, 2015 at 18:30
  • Can't hurt to try.
    – MDMoore313
    Mar 30, 2015 at 18:32
  • @RyanRies Thanks, but well, I don't think that would be a problem. Yes, even Domain Admins couldn't modify, but that property, as far I can see, is not modified very often, like "password never expires", "account disabled" etc, those things would be set up before and maybe once. What do you think? :)
    – esserafael
    Mar 30, 2015 at 18:44
  • Just be sure and document what you do so that the next administrator has a clue what he or she is walking into. :) Also, beware of AdminSDHolder. He's a cruel trickster.
    – Ryan Ries
    Mar 30, 2015 at 18:50
  • ADminSDholder shouldn't affect user accounts
    – Jim B
    Mar 31, 2015 at 20:23

1 Answer 1

Reset to default
0

You'd have to use a group other than "everyone" but presuming you have a working general "deny", if accounts are being "accidentally" disabled you should be able to track that person down who is disabling accounts to deliver re-reducation via the eventlog. Other than inconvenience there is no harm in disabling an account but if you needed to in case of emergency (compromise), you'd now have to track down the right person to disable the account. How "bad" that practice is depends on your appetite for risk of being potentially unable to disable a compromised account readily.

Improve this answer
1
  • Thanks for the asnwer, I was referring to disabling an account manually, from a script, etc., not it getting locked from bad password attempts or something.
    – esserafael
    Mar 30, 2015 at 18:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .