Re: Access Rights to See DACLs in ADAM

I understand we cannot totally sandbox ADAM from the local system
administrators, but we want to make it necessary for a local administrator to
go through all those steps.

As to your questions below, I am using LDP to access the security
descriptors, and even though the ADAM service account has been added to the
Administrators group in the configuration partition, I still see audit
failures relating to Read_Control and Access_Sys_Sec in the security log.

This is true even though I just had to reinstall one of the replicas on the
server, and explicitly named the local administrators group (as a test) as
the ADAM administrators during the creation process.

I even tried creating a separate Windows ADAM administrator account, and had
the same problem with that account as the service account.

Why is ADAM not acknowledging that these Windows accounts are part of the
Administrators role, and granting them access to the security descriptors?
That seems to be the basic problem, although they are treated as
administrators for other purposes, such as viewing and updating directory
objects.

Thanks.
--
Jeffrey Harris, MCSE W2K.
Please remove the '1's from the e-mail address before sending.


"Lee Flight" wrote:

Hi

you cannot really sandbox ADAM from Windows admins
as they have control over the service account, can take ownership,
restore an instance etc,. Also best practice is to keep ADAM
service account and ADAM Admin account separate, see
guidelines on account selection in ADAM help file.

On security descriptors how are you trying to read them?
Adding a windows user to the ADAM Admin role should
allow you to see DACLs. If you are using code then SD is not returned
by default you need to request it using SERVER_SD_FLAGS_OID
control, if you ldp SD editor UI you should be OK. Using code
or ldp.exe if you request SACL info then the account you are using
needs Access System Security priv else it will fail.

Lee Flight


"Jeffrey Harris" <1Jeffrey1.1Harris1@xxxxxxxxxxxxxxxx> wrote in message
news:EA27966A-2948-47EB-B57A-D50CBFA5D042@xxxxxxxxxxxxxxxx
We have set up ADAM SP1 on a W2K3 server.

For security reasons, the local and domain administrators are not allowed
to
access the ADAM instance; only the ADAM service account and designated
ADAM
accounts have the administrator access rights.

When creating the ADAM instance, I configured the service account as the
ADAM administrator. Although the service account has full access, it
cannot
see the DACLs and and SACLs, and owner and group information. Apparently,
read access to these is tied inheritantly to the local administrators
group,
even if that group has no rights in ADAM. With no rights, the local
administrator cannot access that information either. However, If I add
the
local administrator account to the Administrators group, and then log into
ldp as the local administrator, I can see all the DACLs and SACLs.
However,
no matter what I have tried (short of adding the ADAM service account to
the
local administrators group, which we do not want to do, and which I have
not
tried), there appears to be no way to grant the ADAM service account
access
to view the DACLs and SACLs.

Is there a way to grant a given account the ability to see these?

Thanks.
--
Jeffrey Harris, MCSE W2K.
Please remove the '1's from the e-mail address before sending.



.

Relevant Pages

  • Re: Access Rights to See DACLs in ADAM
    ... as they have control over the service account, can take ownership, ... Also best practice is to keep ADAM ... accounts have the administrator access rights. ... local administrators group, which we do not want to do, and which I have ...
    (microsoft.public.windows.server.active_directory)
  • Re: Issue while setting user password in ADAM using JAVA
    ... Secondly I followed few more links and tried to configure ADAM for ... If ADAM is running under a local service account, ... has sufficient rights to update the serviceConnectionPoint object. ... ServiceConnectionPoint object publication can be disabled for this ...
    (microsoft.public.windows.server.active_directory)
  • Re: Azman: AzAuthorizationStoreClass.Initialize
    ... you might try enabling Audit Privilege Use in the security policy on the ... > ADAM on the WinServer 2003 box. ... > I had a service account created and we are doing an impersonation. ... > I added the service account to the readers role and the administrator role ...
    (microsoft.public.windows.server.active_directory)
  • Re: How to alter ADAM administrative rights?
    ... I find it most useful to make the local built in administrators group on the server be the ADAM admin. ... It is pretty natural to want the administrator to be an admin in ADAM and it is also then easy to add a domain group to local admins. ... By "administrative account", I mean the one that is set on the "ADAM ...
    (microsoft.public.windows.server.active_directory)
  • Re: ADAM Security Events
    ... ADAM SACLs can only be set with code. ... >>I want to enable security audting for ADAM. ... What privledges must I give to the service account? ...
    (microsoft.public.windows.server.active_directory)