TopicActive Directory →
Simple definition
An AD object that serves as a permission template for certain accounts and protected groups.
Technical definition
The SDProp mechanism periodically applies AdminSDHolder’s ACLs to objects considered protected.
What’s the point? ?
Maintain consistent LCAs on preferred accounts.
Concrete example
A member of the Domain Admins may have his or her inherited permissions modified by this mechanism.
Common problems
- Crashed custom permissions.
- Formerly privileged account maintaining adminCount.
- Poor understanding of the, legacy.
Related terms
SDProp. · part of the project.
To be noted: precise behaviors and commands may vary depending on the versions, products and architectures.