Q: When I create a new user object in Active Directory (AD), it's automatically assigned a default set of permissions known as the default security descriptor. How can I retrieve the default security descriptor of a particular object class? How can I change it? Are there any changes in how to do this in Windows Server 2003 compared with Windows 2000?
A: For every AD object class (e.g., user, group), Microsoft has defined a default security descriptor that describes the default permissions that are set when an AD object instance of a particular object class is created. Windows 2003 includes some important changes related to the management of the default security descriptor for AD objects. Windows 2003 includes changes to the way you define the content of this security descriptor and the way that you can apply and re-apply to it a particular object instance.
You can set the default security descriptor from the properties of an AD object class. The easiest way to do this is by using the Microsoft Management Console (MMC) Active Directory Schema snap-in. Before you can use this snap-in, you must register the schmmgmt.dll. To do so type the following at a command line: . . .
Register
jeetbhatia@yahoo.com January 10, 2007 (Article Rating: