Defining an AD Object's Default Security Descriptor

A: For every AD object class (e.g., user, group), Microsoft has defined a default security descriptor that describes the default permissions that are set when an AD object instance of a particular object class is created. Windows 2003 includes some important changes related to the management of the default security descriptor for AD objects. Windows 2003 includes changes to the way you define the content of this security descriptor and the way that you can apply and re-apply to it a particular object instance.

You can set the default security descriptor from the properties of an AD object class. The easiest way to do this is by using the Microsoft Management Console (MMC) Active Directory Schema snap-in. Before you can use this snap-in, you must register the schmmgmt.dll. To do so type the following at a command line: . . .