You implement the Active Directory administrative delegation module by merging the O you design with
the permissions on the O use.
This enables delegated administrators to fulfill administrative tasks to create the administrative task
module and design the O use structure to support it.
You must understand how active directory administrative delegation works.
You must also understand the options for delegating administrative control.
So how do users get permissions When users sign into an Active Directory Domain.
They receive a token a token is a list of the seeds of their individual account.
Historical accounts and every group they belong to even recursively if any group was migrated from another
domain it is likely that they also received the historical seeds of those groups in the form or domain
and Windows operating systems.
Many objects such as files folders the registry keys processes and Active Directory objects contain
a security descriptor based on seed the security descriptor defines which rights are granted or denied
to whom.
When a user browses files and folders or register keys or navigates through the Active Directory Domain
structure the system compares the list of seats in the token with a list of seats in the security descriptor.
If there are any matching seats the system relegates the type of access and allows or prohibits the
current operation.
Now let's review Active Directory or you permissions and Active Directory object security descriptors
first permissions in Active Directory of the permission model is more complex than in most other Windows
operating system services security settings on the Active Directory Domain are inherited hierarchical
in the 0 use structure the domain.
At any point in the structure you can configure additional security settings that could be inherited
throughout the hierarchy depending on the scope of inheritance that the security is set and defines
and whether inheritance is blocked at a local level.
New objects obtain default security Saturns which is a schema class defines and inherit security assets
from their parents.
For example in the 0 use Schema Definition account operators has full rights to create and delete objects
for computer accounts user accounts group objects and iiNet or virus and objects.
Therefore if you remove the default account Operators Group from the security permissions over know
you and then create a child or you the child or you retains the explicit security settings of the account
operators.
Now let's talk about the Active Directory object security descriptors a security descriptor of an Active
Directory object contains the following pirates the owner of the object the owner can reset security
assets even when he or she accidentally configured them to have no permissions on the object and other
part of security descriptor.
The primary group of the owner the next part is a control field that specifies whether the discretionary
access control list or Darko or system access control list or cycle is present or is block in inheritance.
There are two other parts of security descriptor an optional Darko and an optional cycle.
The first one contains permissions for granting or denying access and the second one contains the audit
and permissions for when you have enabled.
Success or failure audit in the dark darker land cycle are containers that contain one or more access
control entries or a C e n ac stores.
The following information who is allowed or denied access would permissions are granted to the security
principle.
Read riot create or delete on which objects or object attributes can an action be performed.
And at what sub levels can an action be performed in the O U properties dialog box.
You use the security tap in particular the ID when security dialog box to verify or adjust security
systems.
The security delegation Vizard assists with some common tasks but you cannot use it to review the security
settings.