Home > Access > Access Provisioning

Access Provisioning

Access Provisioning in Active Directory

Given Active Directory's foundational role in Windows based IT infrastructures, organizations often have a need to provision access to Active Directory's contents for various Active Directory integrated features and/or applications and Active Directory's powerful security model also enables organizations to efficiently and securely provision such access, and do so based on the principle of least privilege, thereby reducing the number of users that need to possess administrative access in Active Directory.


Access provisioning is implemented by granting a security principal (e.g. a group) specific permissions that are needed to perform specific actions on Active Directory contents, in the ACLs of Active Directory objects on which such access is required.


The following is a categorized list of some common access provisioning needs in Active Directory -

Category
.		 Required Access
.		 How to Provision  (i.e. what security permissions to grant in Active Directory ACLs)
.
User Account Management
  1. Create a user account
  2. Delete a user account
  3. Reset the password of a user account
  4. Disable/enable a user account
  5. Unlock locked a user account
  6. Unexpire expired a user account
  7. Change the logon name of a user account
  8. Change the logon name (pre Windows 2000) of a user account
  9. Change the SAM Account Name of a user account
  10. Change the User Principal Name (UPN) of a user account
  11. Change the logon hours of a user account
  12. Change the logon workstations of a user account
  13. Change the logon script of a user account
  14. Change the profile path of a user account
  15. Change the jpegPhoto of a user account
  16. Change alternate security identities associated with a user account
  17. Change the first name of a user account
  18. Change the last name of a user account
  19. Change the department of a user account
  20. Change the organizational title of a user account
  21. Change the office location of a user account
  22. Change the telephone number of a user account
  23. Change the company of a user account
  24. Change whether or not a user account is trusted for delegation
  25. Change whether or not a user account is sensitive and cannot be delegated
  26. Change whether or not Kerberos pre-authentication is required for a user account
  27. Change whether or not DES encryption types should be used for a user account
  28. Change the list of certificates issued to a user account
  29. Change the list of SPNs a user account is allowed to delegate to (Constrained Delegation)
  30. Change the security permissions protecting a user account

  Allow  Create Child  User (bf967aba-0de6-11d0-a285-00aa003049e2)

  Allow  Standard Delete   or on parent:  Allow  Delete Child  User (bf967aba-0de6-11d0-a285-00aa003049e2)

  Allow  Extended Right  Reset Password (00299570-246d-11d0-a768-00aa006e0529)

  Allow  Write Property  userAccountControl (bf967a68-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  lockoutTime (28630ebf-41d5-11d1-a9c1-0000f80367c1)

  Allow  Write Property  accountExpires (bf967915-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  userPrincipalName (28630ebb-41d5-11d1-a9c1-0000f80367c1)

  Allow  Write Property  sAMAccountName (3e0abfd0-126a-11d0-a060-00aa006c33ed)

  Allow  Write Property  sAMAccountName (3e0abfd0-126a-11d0-a060-00aa006c33ed)

  Allow  Write Property  userPrincipalName (28630ebb-41d5-11d1-a9c1-0000f80367c1)

  Allow  Write Property  logonHours (bf9679ab-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  userWorkstations (bf9679d7-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  scriptPath (bf9679a8-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  profilePath (bf967a05-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  jpegPhoto (bac80572-09c4-4fa9-9ae6-7628d7adbe0e)

  Allow  Write Property  altSecurityIdentities (00fbf30c-91fe-11d1-aebc-0000f80367c1)

  Allow  Write Property  givenName (f0f8ff8e-1191-11d0-a060-00aa006c33ed)

  Allow  Write Property  sn (bf967a41-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  department (bf96794f-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  title (bf967a55-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  physicalDeliveryOfficeName (bf9679f7-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  telephoneNumber (bf967a49-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  telephoneNumber (bf967a49-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  company (f0f8ff88-1191-11d0-a060-00aa006c33ed)

  Allow  Write Property  userAccountControl (bf967a68-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  userAccountControl (bf967a68-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  userAccountControl (bf967a68-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  userCertificate (bf967a7f-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  msDS-AllowedToDelegateTo (800d94d7-b7a1-42a1-b14d-7cae1423d07f)

  Allow  Modify Permissions

Note - To identify who is actually provisioned the above access in Active Directory, one needs to determine/calculate Active Directory Effective Permissions. For details, please note titled Important at the bottom of this page.


Computer Account Management
  1. Create a computer account
  2. Delete a computer account
  3. Reset the password of a computer account
  4. Disable/enable a computer account
  5. Change the computer name of a computer account
  6. Change the DNS host name of a computer account
  7. Change the machine role of a computer account
  8. Change the 'Trust computer for delegation' setting on a computer account
  9. Change the Service Principal Name (SPN) of a computer account
  10. Change alternate security identities associated with a computer account
  11. Change the list of SPNs a computer account is allowed to delegate to (Constrained Delegation)
  12. Change the security permissions protecting a computer account

  Allow  Create Child  Computer (bf967a86-0de6-11d0-a285-00aa003049e2)

  Allow  Standard Delete   or on parent:  Allow  Delete Child  Computer (bf967a86-0de6-11d0-a285-00aa003049e2)

  Allow  Extended Right  Reset Password (00299570-246d-11d0-a768-00aa006e0529)

  Allow  Write Property  userAccountControl (bf967a68-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  sAMAccountName (11d0-a285-00aa003049e2)

  Allow  Validated Write  to DNS Host Name (72e39547-7b18-11d1-adef-00c04fd8d5cd)

  Allow  Write Property  machineRole (bf9679b2-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  userAccountControl (bf967a68-0de6-11d0-a285-00aa003049e2)

  Allow  Validated Write  to Service Principal Name (f3a64788-5306-11d1-a9c5-0000f80367c1)

  Allow  Write Property  altSecurityIdentities (00fbf30c-91fe-11d1-aebc-0000f80367c1)

  Allow  Write Property  msDS-AllowedToDelegateTo (800d94d7-b7a1-42a1-b14d-7cae1423d07f)

  Allow  Modify Permissions

Note - To identify who is actually provisioned the above access in Active Directory, one needs to determine/calculate Active Directory Effective Permissions. For details, please note titled Important at the bottom of this page.


Security Group Management
  1. Create a security group
  2. Delete a security group
  3. Change the membership of a security group
  4. Add/remove oneself from a security group
  5. Change the scope of a security group
  6. Change the type of a security group
  7. Change the email-address of a security group
  8. Change the description of a security group
  9. Change the designated manager of a security group
  10. Change the security permissions protecting a security group

  Allow  Create Child  Group (bf967a9c-0de6-11d0-a285-00aa003049e2)

  Allow  Standard Delete   or on parent:  Allow  Delete Child  Group (bf967a9c-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  member (bf9679c0-0de6-11d0-a285-00aa003049e2)

  Allow  Validated Write  Add/Remove Self as Member (bf9679c0-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  groupType (9a9a021e-4a5b-11d1-a9c3-0000f80367c1)

  Allow  Write Property  groupType (9a9a021e-4a5b-11d1-a9c3-0000f80367c1)

  Allow  Write Property  mail (bf967961-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  description (bf967950-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  managedBy (0296c120-40da-11d1-a9c0-0000f80367c1)

  Allow  Modify Permissions

Note - To identify who is actually provisioned the above access in Active Directory, one needs to determine/calculate Active Directory Effective Permissions. For details, please note titled Important at the bottom of this page.


Group Policy Management
  1. Create a GPO
  2. Delete a GPO
  3. Change the security permissions protecting a GPO

  Allow  Create Child  Group Policy Container (f30e3bc2-9ff0-11d1-b603-0000f80367c1)

  Allow  Standard Delete   or on parent:  Allow  Delete Child  GPC (f30e3bc2-9ff0-11d1-b603-0000f80367c1)

  Allow  Modify Permissions

Note - To identify who is actually provisioned the above access in Active Directory, one needs to determine/calculate Active Directory Effective Permissions. For details, please note titled Important at the bottom of this page.


Service Connection Point (SCP) Management
  1. Create a service connection point
  2. Delete a service connection point
  3. Change a service connection point's vendor
  4. Change a service connection point's keywords
  5. Change a service connection point's description
  6. Change a service connection point's version number
  7. Change a service connection point's service binding information
  8. Change a service connection point's service class name
  9. Change a service connection point's service DNS name
  10. Change a service connection point's service DNS name type
  11. Change the security permissions protecting a service connection point

  Allow  Create Child  Service Connection Point (28630ec1-41d5-11d1-a9c1-0000f80367c1)

  Allow  Standard Delete   or on parent:  Allow  Delete Child  SCP (28630ec1-41d5-11d1-a9c1-0000f80367c1)

  Allow  Write Property  vendor (281416df-1968-11d0-a28f-00aa003049e2)

  Allow  Write Property  keywords (bf967993-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  description (bf967950-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  versionNumber (bf967a76-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  serviceBindingInformation (b7b1311c-b82e-11d0-afee-0000f80367c1)

  Allow  Write Property  serviceClassName (b7b1311d-b82e-11d0-afee-0000f80367c1)

  Allow  Write Property  serviceDNSName (28630eb8-41d5-11d1-a9c1-0000f80367c1)

  Allow  Write Property  serviceDNSNameType (28630eba-41d5-11d1-a9c1-0000f80367c1)

  Allow  Modify Permissions

Note - To identify who is actually provisioned the above access in Active Directory, one needs to determine/calculate Active Directory Effective Permissions. For details, please note titled Important at the bottom of this page.


Published Printer Management
  1. Publish a printer in Active Directory
  2. Delete a published printer from Active Directory
  3. Change the description of a printer published in Active Directory
  4. Change the share name of a printer published in Active Directory
  5. Change the security permissions protecting a published printer

  Allow  Create Child  Print Queue (bf967aa8-0de6-11d0-a285-00aa003049e2)

  Allow  Standard Delete   or on parent:  Allow  Delete Child  Print Queue (bf967aa8-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  description (bf967950-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  printShareName (ba305f68-47e3-11d0-a1a6-00c04fd930c9)

  Allow  Modify Permissions

Note - To identify who is actually provisioned the above access in Active Directory, one needs to determine/calculate Active Directory Effective Permissions. For details, please note titled Important at the bottom of this page.


OU & Container Management
  1. Create an organizational unit
  2. Delete an organizational unit
  3. Create a container
  4. Delete a container
  5. Change the description of an organizational unit
  6. Change the description of a container
  7. Link group policies to an organizational unit
  8. Change precedence of group policies linked to an organizational unit
  9. Generate resultant set of policy for users/computers (Logging Mode)
  10. Generate resultant set of policy for users/computers (Planning Mode)
  11. Change the security permissions protecting an organizational unit
  12. Change the security permissions protecting a container

  Allow  Create Child  Organizational Unit (bf967aa5-0de6-11d0-a285-00aa003049e2)

  Allow  Standard Delete   or on parent:  Allow  Delete Child  Organizational Unit (bf967aa5-0de6-11d0-a285-00aa003049e2)

  Allow  Create Child  Container (bf967a8b-0de6-11d0-a285-00aa003049e2)

  Allow  Standard Delete   or on parent:  Allow  Delete Child  Container (bf967a8b-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  description (bf967950-0de6-11d0-a285-00aa003049e2)

  Allow  Write Property  description (bf967950-0de6-11d0-a285-00aa003049e2)

  See Note 2 below

  See Note 2 below

  Allow  Extended Right  Generate Resultant Set of Policy (Logging) (b7b1b3de-ab09-4242-9e30-9980e5d322f7)

  Allow  Extended Right  Generate Resultant Set of Policy (Planning) (b7b1b3dd-ab09-4242-9e30-9980e5d322f7)

  Allow  Modify Permissions

  Allow  Modify Permissions

Note - To identify who is actually provisioned the above access in Active Directory, one needs to determine/calculate Active Directory Effective Permissions. For details, please note titled Important at the bottom of this page.


Domain Management
  1. Replicate secrets from an Active Directory domain
  2. Synchronize replication from an Active Directory domain
  3. Manage replication topology from an Active Directory domain
  4. Monitor replication topology for an Active Directory domain
  5. Create an inbound forest trust relationship (forest root domain only)
  6. Change the security permissions protecting the domain root

  See Note 3 below

  Allow  Extended Right  Replication Synchronization (1131f6ab-9c07-11d1-f79f-00c04fc2dcd2)

  Allow  Extended Right  Manage Replication Topology (1131f6ac-9c07-11d1-f79f-00c04fc2dcd2)

  Allow  Extended Right  Monitor Active Directory Replication (f98340fb-7c5b-4cdb-a00b-2ebdfa115a96)

  Allow  Extended Right  Create Inbound Forest Trust (e2a36dc9-ae17-47c3-b58b-be34c55ba633)

  Allow  Modify Permissions

Note - To identify who is actually provisioned the above access in Active Directory, one needs to determine/calculate Active Directory Effective Permissions. For details, please note titled Important at the bottom of this page.





Important - Access provisioning in Active Directory is also straightforward, easy and can be done with precision. However, assessing who is provisioned what access in Active Directory is not quite as easy or straightforward, because there invariably also exist other security permissions in the ACLs of the same Active Directory objects, and they could influence the resulting access on these objects, and as a result (intentionally or otherwise) end up either denying access to provisioned security principals and/or granting similar access to others as well, which is why assessing, auditing and/or verifying provisioned access in Active Directory requires the calculation of Active Directory Effective Permissions on all objects in the scope of provisioned access.