Simple definition
An AD object that serves as a permission template for certain accounts and protected groups.
Technical definition
The SDProp mechanism periodically applies AdminSDHolder’s ACLs to objects considered protected.
What is AdminSDHolder used for?
Maintain consistent access control lists (ACLs) for protected Active Directory accounts and groups.
Practical example
Membership in Domain Admins may cause an account to be protected by SDProp, which can reset its permissions to match the AdminSDHolder template.
Common problems
- Crashed custom permissions.
- Formerly privileged account maintaining adminCount.
- Poor understanding of the, legacy.
Related terms
To be noted: precise behaviors and commands may vary depending on the versions, products and architectures.