Active Directory Cookbook

14.11. Changing the Default ACL for an Object Class in the Schema

Problem

You want to change the default ACL for an object class in the schema.

Solution

Using a graphical user interface

1. Open the Active Directory Schema snap-in.

2. In the left pane, browse to the class you want to modify.

3. Right-click on it and select Properties.

4. Select the Default Security tab.

5. Use the ACL Editor to change the ACL.

6. Click OK.

Tip

The Default Security tab is available only in the Windows Server 2003 version of the Active Directory Schema snap-in. See MS KB 265399 for the manual approach that is needed with Windows 2000.

Discussion

Each instantiated object in Active Directory has an associated structural class that defines a default security descriptor ( defaultSecurityDescriptor attribute). When an object is created, the default security descriptor is applied to it. This, along with inheritable permissions from the parent container, determines how an object’s security descriptor is initially defined.

See Also

Recipe 14.12 for comparing the ACL of an object to the default defined in the schema, Recipe 14.13 for resetting the ACL of an object to that defined in the schema, and MS KB 265399 (HOW TO: Change Default Permissions for Objects That Are Created in the Active Directory)