Re: ACL on GPO link

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

On 3 avr, 06:41, "Darren Mar-Elia" <dmanonym...@xxxxxxxxxxxxx> wrote:
To take it a step further from what Mark has said, if, for example, an
administrator was not domain admin equivalent and could not take ownership
of any AD object and change its permissions, you could prevent them from the
writing the gpLink attribute on the domain NC head. That would effectively
prevent them from unlinking your GPO. But, because of the way links are
stored, they would also not be able to add any new links to the domain, nor
remove other GPO links. The gpLink attribute is monolithic in that each link
is stored in a concatenated list of GPO Guids (along with a flag). Thus
being able to write the gpLink attribute means you can link or unlink any
GPO from that container and not being able to write to it means...that you
can't!

hope that helps.

Darren

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
*******************************
Secure and configure your Windows desktops accurately every time without
having to learn or install new technology.
Find out more about Desktop Policy Manager athttp://www.sdmsoftware.com/desktop_management
*******************************

"Mark Heitbrink [MVP]" <spam-o...@xxxxxxxxxxxxxxxxxxxxx> wrote in messagenews:efeI1rOlIHA.5820@xxxxxxxxxxxxxxxxxxxxxxx



Hi,

Johni schrieb:
Somebody who has the rights to manage links car delete my GPO link and
then put a link with his own GPO, with different policies.

... but only if he has the right to write/change files inside SYSVOL and
objects inside cn=policies,cn=system,dc=yourdom,dc=dom

That means: He es a Admin. And if he is a Admin, you can not deny
ANYTHING!
A person who can manage links everywhere is aswell an admin ...

Creation and Linking are two seperate roles, because they appear at
different objects.

If someone is permitted to link, he has at least the right of modify
the "gpLink" Attribute on a Site, Domain or OU, which can be delegated.
But if he is permitted to link, he is not allowed to create a OU, he only
can link a existing one.
If someone is allowed to create a GPO, he does not nessesarly has the
right to link this object on every OU.

If someone is "unlinking" your GPO and replacing it, then you do not have
a problem that can be catched by security options, it only can be handled
by his employee contract. If he is reverting settings a Doman Admin has
set, than this usually happens only once. The secound time he is no longer
an employee ... easy and functional. So, no Problem at all.

Mark
--
Mark Heitbrink - MVP Windows Server - Group Policy

Homepage:www.gruppenrichtlinien.de- deutsch
Blog:     gpupdate.spaces.live.com  - english- Masquer le texte des messages précédents -

- Afficher le texte des messages précédents -


Thanks for your answers, Mark and Darren.
I understood the technical reasons.
I conclude that you cannot prevent an AD administrator (god) from
changing application of a specific set of policies. It's impossible.
If I have a security application based on policies and I want that its
settings can only be changed by a few people, and not all the system
administrors, I can't.
But even if I could put ACL on specific GPO links, it wouldn't be
enough, because AD admins can reset a password and use another
account.
The only solution is to use a custom config server, based on a private
authentication mechanism
.
Never mind, I juste wanted to be sure that I clearly understood GPO
links. Thanks again.

JS






.

Relevant Pages

  • Re: Security Filtering does not work correctly in GPO
    ... administrator object for this GPO. ... I deleted the domain admin profile on the ... where the domain admin was logged on. ... I will now keep track on it, if the administrator receices the settings again. ...
    (microsoft.public.windows.server.active_directory)
  • Re: ACL on GPO link
    ... To take it a step further from what Mark has said, if, for example, an administrator was not domain admin equivalent and could not take ownership of any AD object and change its permissions, you could prevent them from the writing the gpLink attribute on the domain NC head. ... But, because of the way links are stored, they would also not be able to add any new links to the domain, nor remove other GPO links. ...
    (microsoft.public.windows.group_policy)
  • Re: IfMember & Adding Domain Group to Local Admin Group
    ... You can do this very easily with GPO. ... you should be aware that if you log in to any of these workstations ... > administrator group of the workstations only. ... does IfMember work with computer accounts or just user ...
    (microsoft.public.win2000.group_policy)
  • Re: Manually added user rights assignments
    ... Are you attempting to set this is a GPO of AD that is applied ... OU (containing the servers) not to the domain and are ... Also, if you have TS installed in admin mode on W2k, or you ... > Have been trying to add the buit-in Admin accounts of my members servers ...
    (microsoft.public.windows.group_policy)
  • Re: Security Filtering does not work correctly in GPO
    ... Did you removed the Authenticated Users from apply GPO ... Systems Administrator ... "Scope-Setting" in the Group Policy object. ... The domain admin shouln't receive this settings. ...
    (microsoft.public.windows.server.active_directory)