Microsoft® Windows® Security Resource Kit, Second Edition

Securing Active Directory Objects and Attributes

In Active Directory, all attributes of all objects and the objects themselves have permissions that can be defined when the object is created or after it has been created. You must be able to examine these permissions and secure them according to your organization’s security policy. This is especially true if your organization is planning on extending the Active Directory Schema to include additional attributes or objects.

You can secure Active Directory objects at their creation globally for all newly created objects of a given object class by modifying the default security descriptor for the object class in the schema. You can also secure objects after their creation by creating an object-specific ...