Toon posts:

[win2k8 64bit std]DSACLS na dsadd voor OU delete bescherming

Pagina: 1
Acties:

woensdag 1 april 2009 13:36

Acties:
  • WPN
  • Registratie: Augustus 2003
  • Laatst online: 25-11-2025

WPN

Topicstarter
Ik ga binnenkort een complete nieuw 2008 domain from scratch bouwen.

Hierbij ben ik dus in VM aan het testen en voorbereiden.

Ik heb een structuur bedacht voor mn OU's en die bouw ik nu compleet op met een batch file doormiddel van DSADD.
Dit werkt perfect, echter wil ik ook dat de OU en alle childs daarin beschermd worden voor accidental deletion of versleping....
Dit staat standaard aan als je alles opbouwd vanuit de ADUC maar wanneer je gebruik maakt van DSADD staat deze bescherming dus niet aan.

Omdat dit per OU aangepast moet worden ben ik opzoek gegaan naar een cmdline tool, hierop is dus DSACLS eruit gekomen (standaard in win).

Op verschillende sites gekeken o.a.:
http://technet.microsoft....y/aa998151(EXCHG.65).aspx
http://social.technet.mic...0-4428-ab04-a9f1334868dc/
http://msmvps.com/blogs/u...-windows-server-2008.aspx

er zijn meer site die ik bekeken heb maar puntje bij paaltje komt het op de volgende command uit:
code:
1

dsacls ou=MyUsers,dc=example,dc=com /d Everyone:SDDT


ik heb voor mijn situatie dit er van gemaakt:
code:
1

dsacls "ou=BOZW,dc=bozw,dc=local" /d Everyone:SDDT

en
code:
1
2

dsacls "ou=BOZW,dc=bozw,dc=local" /d Everyone:SDDT /I:T
/I:T zorgt voor inherit


ik krijg hierbij een succesvolle uitovering van het command:

code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180

C:\Users\Administrator>dsacls "ou=BOZW,dc=bozw,dc=local" /d everyone:SDDT
Owner: BOZW\Domain Admins
Group: BOZW\Domain Admins

Access list:
Deny  Everyone                        SPECIAL ACCESS
                                      DELETE
                                      DELETE TREE
Deny  Everyone                        SPECIAL ACCESS
                                      DELETE
                                      DELETE CHILD
                                      DELETE TREE
Deny  Everyone                        SPECIAL ACCESS
                                      DELETE
                                      DELETE TREE
Allow BOZW\Domain Admins              FULL CONTROL
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      SPECIAL ACCESS
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Allow NT AUTHORITY\Authenticated Users
                                      SPECIAL ACCESS
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Allow NT AUTHORITY\SYSTEM             FULL CONTROL
Allow BOZW\Enterprise Admins          FULL CONTROL   <Inherited from parent>
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS   <Inherited from parent>
                                      LIST CONTENTS
Allow BUILTIN\Administrators          SPECIAL ACCESS   <Inherited from parent>
                                      DELETE
                                      READ PERMISSONS
                                      WRITE PERMISSIONS
                                      CHANGE OWNERSHIP
                                      CREATE CHILD
                                      LIST CONTENTS
                                      WRITE SELF
                                      WRITE PROPERTY
                                      READ PROPERTY
                                      LIST OBJECT
                                      CONTROL ACCESS
Allow BUILTIN\Account Operators       SPECIAL ACCESS for inetOrgPerson
                                      CREATE CHILD
                                      DELETE CHILD
Allow BUILTIN\Account Operators       SPECIAL ACCESS for computer
                                      CREATE CHILD
                                      DELETE CHILD
Allow BUILTIN\Account Operators       SPECIAL ACCESS for group
                                      CREATE CHILD
                                      DELETE CHILD
Allow BUILTIN\Print Operators         SPECIAL ACCESS for printQueue
                                      CREATE CHILD
                                      DELETE CHILD
Allow BUILTIN\Account Operators       SPECIAL ACCESS for user
                                      CREATE CHILD
                                      DELETE CHILD
Allow NT AUTHORITY\SELF               SPECIAL ACCESS for Private Information   <
Inherited from parent>
                                      WRITE PROPERTY
                                      READ PROPERTY
                                      CONTROL ACCESS

Permissions inherited to subobjects are:
Inherited to all subobjects
Deny  Everyone                        SPECIAL ACCESS
                                      DELETE
                                      DELETE TREE
Allow BOZW\Enterprise Admins          FULL CONTROL   <Inherited from parent>
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS   <Inherited from parent>
                                      LIST CONTENTS
Allow BUILTIN\Administrators          SPECIAL ACCESS   <Inherited from parent>
                                      DELETE
                                      READ PERMISSONS
                                      WRITE PERMISSIONS
                                      CHANGE OWNERSHIP
                                      CREATE CHILD
                                      LIST CONTENTS
                                      WRITE SELF
                                      WRITE PROPERTY
                                      READ PROPERTY
                                      LIST OBJECT
                                      CONTROL ACCESS
Allow NT AUTHORITY\SELF               SPECIAL ACCESS for Private Information   <
Inherited from parent>
                                      WRITE PROPERTY
                                      READ PROPERTY
                                      CONTROL ACCESS

Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS   <Inherited from parent>
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Inherited to group
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS   <Inherited from parent>
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS   <Inherited from parent>
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Inherited to user
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      SPECIAL ACCESS for tokenGroups   <Inherite
d from parent>
                                      READ PROPERTY
Inherited to group
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      SPECIAL ACCESS for tokenGroups   <Inherite
d from parent>
                                      READ PROPERTY
Inherited to computer
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      SPECIAL ACCESS for tokenGroups   <Inherite
d from parent>
                                      READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Remote Access Informati
on   <Inherited from parent>
                                      READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Remote Access Informati
on   <Inherited from parent>
                                      READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for General Information   <
Inherited from parent>
                                      READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for General Information   <
Inherited from parent>
                                      READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Group Membership   <Inh
erited from parent>
                                      READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Group Membership   <Inh
erited from parent>
                                      READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Logon Information   <In
herited from parent>
                                      READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Logon Information   <In
herited from parent>
                                      READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Account Restrictions
<Inherited from parent>
                                      READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Account Restrictions
<Inherited from parent>
                                      READ PROPERTY
[b]The command completed successfully[/b]


hier op het eind zie je dat het succesvol is....

ik weet niet of de uitvoer (zoals hierboven) een normale uitvoer is voor het aanpassen van 1 OU?

echter ga ik checken of het ook daadwerkelijk zo is dan kom ik tot de conclusie dat het niet zo is:
in ADUC staat er niets aangevinkt voor bescherming
in ADUC kan ik gewoon de OU verwijderen

in de derde website die ik hiervoor noemde staat wel dat het niet altijd werkt maar dat dat misschien een oorzaak was doordat hij nog met een beta werkte....

Ik kan niets in de eventviewer vinden of security errors of iets dergelijks
Het maakt geen verschil of ik wel of niet met een elevated cmd werk....

wat is er fout aan mijn command waarvan hij wel zegt dat het succesvol is uitgevoerd?

Als ik denk zoals ik dacht, dan doe ik zoals ik deed, als ik doe zoals ik deed, dan denk ik zoals ik dacht! Cogito Ergo Sum

woensdag 1 april 2009 15:07

Acties:
  • Question Mark
  • Registratie: Mei 2003
  • Laatst online: 16:14

Question Mark

Moderator SSC/WOS

F7 - Nee - Ja

Ik kan geen fouten in je syntax ontdekken.

Ik ben wel een powershell script tegengekomen wat in grote lijnen hetzelfde doet. Windows 2008 protection from accidental deletion.

Mischien dat je hier wat mee kunt (in het geval je geen Core edition gebruikt). :)

MCSE NT4/2K/2K3, MCTS, MCITP, CCA, CCEA, CCEE, CCIA, CCNA, CCDA, CCNP, CCDP, VCP, CEH + zwemdiploma A & B

woensdag 1 april 2009 16:31

Acties:
  • WPN
  • Registratie: Augustus 2003
  • Laatst online: 25-11-2025

WPN

Topicstarter
dat powershell script had ik ook al geprobeerd, maar ook helaas geen succes :S

het gaat om in iedergeval 52 OU's dus met de hand rechtzetten is nog te doen maar niet iets waar ik naar vooruit kijk om te doen, steek liever die (en meer) tijd in het uitzoeken (en oplossen) van het dsacls gebruik


en nee, ik gebruik de full version en voer het ook direct op de server uit en de administrator account natuurlijk (test omgeving)

[ Voor 18% gewijzigd door WPN op 01-04-2009 16:38 ]

Als ik denk zoals ik dacht, dan doe ik zoals ik deed, als ik doe zoals ik deed, dan denk ik zoals ik dacht! Cogito Ergo Sum

woensdag 1 april 2009 19:41

Acties:
  • Question Mark
  • Registratie: Mei 2003
  • Laatst online: 16:14

Question Mark

Moderator SSC/WOS

F7 - Nee - Ja

Ik kom overigens wel in de diverse artikelen het volgende tegen:
/d {user | group}:permissions: Use this parameter to deny specified permissions to a user or group. User must use either user@domain or domain\user format, and group must use either group@domain or domain\group format. You can specify more than one user or group in a command.
Kun je het eens proberen om met domain\everyone de deny-rechten toe te voegen? (of een andere groep ipv everyone)

MCSE NT4/2K/2K3, MCTS, MCITP, CCA, CCEA, CCEE, CCIA, CCNA, CCDA, CCNP, CCDP, VCP, CEH + zwemdiploma A & B

woensdag 1 april 2009 20:52

Acties:
  • WPN
  • Registratie: Augustus 2003
  • Laatst online: 25-11-2025

WPN

Topicstarter
overheen gelezen dat stuk:

uitvoer:

code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator>dsacls ou=bozw,dc=bozw,dc=local /d BOZW\Everyone:SDDT
No Sid Found for BOZW\Everyone
No mapping between account names and security IDs was done.

The command failed to complete successfully.

C:\Users\Administrator>dsacls ou=bozw,dc=bozw,dc=local /d BOZW.LOCAL\Everyone:SD
DT
No Sid Found for BOZW.LOCAL\Everyone
No mapping between account names and security IDs was done.

The command failed to complete successfully.

C:\Users\Administrator>dsacls ou=bozw,dc=bozw,dc=local /d Everyone@bozw.local:SD
DT
No Sid Found for Everyone@bozw.local
No mapping between account names and security IDs was done.

The command failed to complete successfully.

C:\Users\Administrator>dsacls ou=bozw,dc=bozw,dc=local /d Everyone@bozw:SDDT
No Sid Found for Everyone@bozw
No mapping between account names and security IDs was done.

The command failed to complete successfully.


en met de gebruiker administrator@bozw

code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184

C:\Users\Administrator>dsacls ou=bozw,dc=bozw,dc=local /d administrator@bozw:SDD
T
Owner: BOZW\Domain Admins
Group: BOZW\Domain Admins

Access list:
Deny  BOZW\Administrator              SPECIAL ACCESS
                                      DELETE
                                      DELETE TREE
Deny  Everyone                        SPECIAL ACCESS
                                      DELETE
                                      DELETE TREE
Deny  Everyone                        SPECIAL ACCESS
                                      DELETE
                                      DELETE CHILD
                                      DELETE TREE
Deny  Everyone                        SPECIAL ACCESS
                                      DELETE
                                      DELETE TREE
Allow BOZW\Domain Admins              FULL CONTROL
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      SPECIAL ACCESS
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Allow NT AUTHORITY\Authenticated Users
                                      SPECIAL ACCESS
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Allow NT AUTHORITY\SYSTEM             FULL CONTROL
Allow BOZW\Enterprise Admins          FULL CONTROL   <Inherited from parent>
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS   <Inherited from parent>
                                      LIST CONTENTS
Allow BUILTIN\Administrators          SPECIAL ACCESS   <Inherited from parent>
                                      DELETE
                                      READ PERMISSONS
                                      WRITE PERMISSIONS
                                      CHANGE OWNERSHIP
                                      CREATE CHILD
                                      LIST CONTENTS
                                      WRITE SELF
                                      WRITE PROPERTY
                                      READ PROPERTY
                                      LIST OBJECT
                                      CONTROL ACCESS
Allow BUILTIN\Account Operators       SPECIAL ACCESS for inetOrgPerson
                                      CREATE CHILD
                                      DELETE CHILD
Allow BUILTIN\Account Operators       SPECIAL ACCESS for computer
                                      CREATE CHILD
                                      DELETE CHILD
Allow BUILTIN\Account Operators       SPECIAL ACCESS for group
                                      CREATE CHILD
                                      DELETE CHILD
Allow BUILTIN\Print Operators         SPECIAL ACCESS for printQueue
                                      CREATE CHILD
                                      DELETE CHILD
Allow BUILTIN\Account Operators       SPECIAL ACCESS for user
                                      CREATE CHILD
                                      DELETE CHILD
Allow NT AUTHORITY\SELF               SPECIAL ACCESS for Private Information   <
Inherited from parent>
                                      WRITE PROPERTY
                                      READ PROPERTY
                                      CONTROL ACCESS

Permissions inherited to subobjects are:
Inherited to all subobjects
Deny  Everyone                        SPECIAL ACCESS
                                      DELETE
                                      DELETE TREE
Allow BOZW\Enterprise Admins          FULL CONTROL   <Inherited from parent>
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS   <Inherited from parent>
                                      LIST CONTENTS
Allow BUILTIN\Administrators          SPECIAL ACCESS   <Inherited from parent>
                                      DELETE
                                      READ PERMISSONS
                                      WRITE PERMISSIONS
                                      CHANGE OWNERSHIP
                                      CREATE CHILD
                                      LIST CONTENTS
                                      WRITE SELF
                                      WRITE PROPERTY
                                      READ PROPERTY
                                      LIST OBJECT
                                      CONTROL ACCESS
Allow NT AUTHORITY\SELF               SPECIAL ACCESS for Private Information   <
Inherited from parent>
                                      WRITE PROPERTY
                                      READ PROPERTY
                                      CONTROL ACCESS

Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS   <Inherited from parent>
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Inherited to group
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS   <Inherited from parent>
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS   <Inherited from parent>
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Inherited to user
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      SPECIAL ACCESS for tokenGroups   <Inherite
d from parent>
                                      READ PROPERTY
Inherited to group
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      SPECIAL ACCESS for tokenGroups   <Inherite
d from parent>
                                      READ PROPERTY
Inherited to computer
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      SPECIAL ACCESS for tokenGroups   <Inherite
d from parent>
                                      READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Remote Access Informati
on   <Inherited from parent>
                                      READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Remote Access Informati
on   <Inherited from parent>
                                      READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for General Information   <
Inherited from parent>
                                      READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for General Information   <
Inherited from parent>
                                      READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Group Membership   <Inh
erited from parent>
                                      READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Group Membership   <Inh
erited from parent>
                                      READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Logon Information   <In
herited from parent>
                                      READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Logon Information   <In
herited from parent>
                                      READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Account Restrictions
<Inherited from parent>
                                      READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
                                      SPECIAL ACCESS for Account Restrictions
<Inherited from parent>
                                      READ PROPERTY
The command completed successfully



beide geen success met het te bereiken doel, waarbij de everyone group ook niet herkend wordt (ik kan everyone wel vinden in de security box bij bv rechten toevoegen op een map, dus bestaat wel)

Als ik denk zoals ik dacht, dan doe ik zoals ik deed, als ik doe zoals ik deed, dan denk ik zoals ik dacht! Cogito Ergo Sum

zondag 3 mei 2009 18:05

Acties:
  • WPN
  • Registratie: Augustus 2003
  • Laatst online: 25-11-2025

WPN

Topicstarter
na een tijdje hier niet meer naar gekeken te hebben, heb ik het toch weer even geprobeerd.

Als ik de opdracht neem die ik in mn eerste post heb staan voor mijn situatie (met inherit) dan krijgt de OU BOZW (deze staat dus in de root van het ADUC) dus wel protection, maar alle sub OU's niet.

daarom heb ik een andere oplossing genomen om per OU binnen de BOZW OU de settings aan te passen:
code:
1

for /f %i in ('dsquery ou "ou=bozw,dc=bozw,dc=local" -limit 0') do dsacls %i /d everyone:SDDT


dat werkt dus ook niet, terwijl de opdrachten wel succesvol verwerkt worden.

uitvoer van dsacls op een sub OU:
C:\Users\Administrator>dsacls "OU=cc_acls,OU=callcenter,OU=afdelingen,OU=bozw,DC
=bozw,DC=local" /d everyone:SDDT
Owner: BOZW\Domain Admins
Group: BOZW\Domain Admins

Access list:
Deny Everyone SPECIAL ACCESS
DELETE
DELETE TREE
Allow BOZW\Domain Admins FULL CONTROL
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
SPECIAL ACCESS
READ PERMISSONS
LIST CONTENTS
READ PROPERTY
LIST OBJECT
Allow NT AUTHORITY\Authenticated Users
SPECIAL ACCESS
READ PERMISSONS
LIST CONTENTS
READ PROPERTY
LIST OBJECT
Allow NT AUTHORITY\SYSTEM FULL CONTROL
Deny Everyone SPECIAL ACCESS <Inherited from parent>
DELETE
DELETE TREE
Allow BOZW\Enterprise Admins FULL CONTROL <Inherited from parent>
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS <Inherited from parent>
LIST CONTENTS
Allow BUILTIN\Administrators SPECIAL ACCESS <Inherited from parent>
DELETE
READ PERMISSONS
WRITE PERMISSIONS
CHANGE OWNERSHIP
CREATE CHILD
LIST CONTENTS
WRITE SELF
WRITE PROPERTY
READ PROPERTY
LIST OBJECT
CONTROL ACCESS
Allow BUILTIN\Account Operators SPECIAL ACCESS for inetOrgPerson
CREATE CHILD
DELETE CHILD
Allow BUILTIN\Account Operators SPECIAL ACCESS for computer
CREATE CHILD
DELETE CHILD
Allow BUILTIN\Account Operators SPECIAL ACCESS for group
CREATE CHILD
DELETE CHILD
Allow BUILTIN\Print Operators SPECIAL ACCESS for printQueue
CREATE CHILD
DELETE CHILD
Allow BUILTIN\Account Operators SPECIAL ACCESS for user
CREATE CHILD
DELETE CHILD
Allow NT AUTHORITY\SELF SPECIAL ACCESS for Private Information <
Inherited from parent>
WRITE PROPERTY
READ PROPERTY
CONTROL ACCESS

Permissions inherited to subobjects are:
Inherited to all subobjects
Deny Everyone SPECIAL ACCESS <Inherited from parent>
DELETE
DELETE TREE
Allow BOZW\Enterprise Admins FULL CONTROL <Inherited from parent>
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS <Inherited from parent>
LIST CONTENTS
Allow BUILTIN\Administrators SPECIAL ACCESS <Inherited from parent>
DELETE
READ PERMISSONS
WRITE PERMISSIONS
CHANGE OWNERSHIP
CREATE CHILD
LIST CONTENTS
WRITE SELF
WRITE PROPERTY
READ PROPERTY
LIST OBJECT
CONTROL ACCESS
Allow NT AUTHORITY\SELF SPECIAL ACCESS for Private Information <
Inherited from parent>
WRITE PROPERTY
READ PROPERTY
CONTROL ACCESS

Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS <Inherited from parent>
READ PERMISSONS
LIST CONTENTS
READ PROPERTY
LIST OBJECT
Inherited to group
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS <Inherited from parent>
READ PERMISSONS
LIST CONTENTS
READ PROPERTY
LIST OBJECT
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS <Inherited from parent>
READ PERMISSONS
LIST CONTENTS
READ PROPERTY
LIST OBJECT
Inherited to user
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
SPECIAL ACCESS for tokenGroups <Inherite
d from parent>
READ PROPERTY
Inherited to group
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
SPECIAL ACCESS for tokenGroups <Inherite
d from parent>
READ PROPERTY
Inherited to computer
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
SPECIAL ACCESS for tokenGroups <Inherite
d from parent>
READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS for Remote Access Informati
on <Inherited from parent>
READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS for Remote Access Informati
on <Inherited from parent>
READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS for General Information <
Inherited from parent>
READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS for General Information <
Inherited from parent>
READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS for Group Membership <Inh
erited from parent>
READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS for Group Membership <Inh
erited from parent>
READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS for Logon Information <In
herited from parent>
READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS for Logon Information <In
herited from parent>
READ PROPERTY
Inherited to user
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS for Account Restrictions
<Inherited from parent>
READ PROPERTY
Inherited to inetOrgPerson
Allow BUILTIN\Pre-Windows 2000 Compatible Access
SPECIAL ACCESS for Account Restrictions
<Inherited from parent>
READ PROPERTY
The command completed successfully

Als ik denk zoals ik dacht, dan doe ik zoals ik deed, als ik doe zoals ik deed, dan denk ik zoals ik dacht! Cogito Ergo Sum

Pagina: 1
Reageer

Apple iPhone 17 LG OLED evo G5 Google Pixel 10 Samsung Galaxy S25 Star Wars: Outlaws Nintendo Switch 2 Apple AirPods Pro (2e generatie) Sony PlayStation 5 Pro

Tweakers is onderdeel van DPG Media B.V.
Alle rechten voorbehouden - Auteursrecht © 1998 - 2026 • Hosting door TrueFullstaq