The sensitive shares group, the Domain Admins group, the domain admins accounts, the delegated admins accounts, as well as the groups used to delegate permissions in Active Directory should also exist in this sensitive OU to which only Domain Admins have access.Ħ. To it should be in a sensitive OU, to which only Domain Admins haveĥ. If this is a sensitive file share, the group(s) that control access They should instead be in a separate group which has delegated permissions to manage the AD resources that they require access to manage (Users, Computers, OUs, GPOs, non-sensitive groups)ģ. Your current "domain admins" which you are trying to restrict, should not be Domain Admins. Domain Admins can modify the membership of groups that do have access to the Shares in question - which is why all group changes in AD should be audited (and possibly tripwired)ģ. Domain Admins should not be administrators on workstations or member servers - while it may be default, there is no law or reason that stipulates that this is a requirement.Ģ. File Share ACLs should specifically be crafted to not include the Domain Admins group.
Domain Admins should have access to AD and Domain Controllers they don't necessarily require administrative access to anything else. Your problem is that you do not have the correct people in the Domain Admins group.ġ. I would really appreciate it if someone can point me in the right direction
0 kommentar(er)
