I'm trying to create a user in AD which is undeletable, unmodifiable even by Administrators, Domain Admins.

Is there any problem that might occur if I delete the Full control permission on the user object for Administrators, Domain Admins groups?

I suppose, it would result that the user can only be edited by itself.

  • I believe that this would depend on what directory you are doing this to. Is it the windows directory? If it is, then that would not be a great idea. Please add more information on what you are trying to accomplish and perhaps someone will give you a best practice to assist you. – Citizen Jul 9 '16 at 1:35

No, nothing unexpected will happen, since the system uses the SYSTEM principal and you aren't planning to delete that.

However, what you are planning to do won't stop an administrator from modifying or removing the object. Administrators always have the SeTakeOwnershipPrivilege privilege, which allows them to set the owner of any object to themselves (or a group to which they belong). The owner of an object change the access list arbitrarily, e.g. to remove a deny entry or allow oneself Full Control. Therefore, a determined admin would do something like this:

  1. Take ownership of the object
  2. Add those access rules back with Full Control
  3. Access or demolish the object as normal

You may need to enable ViewAdvanced Features in Active Directory Users and Computers before you're able to see the Security tab on AD objects.

Administrators can do anything.

  • So the best way to avoid it would be to delegate control and demote users who might want to revoke admin rights? – Patrick Mol Jul 8 '16 at 21:15
  • 2
    @PatrickMol The most important thing is that you only make trustworthy people admins. Domain administrators can literally do anything imaginable to your domain, and if you can't trust them as people, you're completely hosed from the start. – Ben N Jul 8 '16 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.