Home > Access > Default Access

Default Access

Default Access in Active Directory

Default access in Active Directory is the totality of all access that is provisioned by default in every Active Directory, and it is the source of the vast majority of default administrative access (privileged access) that actually exists in every Active Directory.

Note - By default there are a total of 54* default accounts and groups in Active Directory, yet only 23 of them have any kind of modify access specified by default within Active Directory, as specified below.


Sources of Default Access

There are 2 sources of default access in Active Directory -

  1. The access that is provisioned by default inside the ACLs of all instantiated objects in a new Active Directory deployment

  2. The access that is specified in the default security descriptors in class object definitions in the Active Directory Schema

When Active Directory is installed, the initial set of objects in the domain are created based on the settings in a specific configuration file which also contains pre-configured values of the NTSecurityDescriptor for each of these initially created objects.

Subsequently, when a new object is created in Active Directory, the (access specified in the) defaultSecurityDescriptor attribute of the Class Schema object of that class becomes the NTSecurityDescriptor of that newly instantiated object and (unless its ACL is marked Protected) additionally, all inheritable ACEs in the ACL of its parent object are inherited by the object and merged into the NTSecurityDescriptor of the object, and access to the object is then governed by Active Directory's security model.

Consequently, the net resulting default access in Active Directory is a combination of the pre-configured access stamped during the initial creation of objects in Active Directory and the access specified in the default security descriptors in the Schema.



A Simple Illustration

This is perhaps best understood with an illustration. Consider a new Active Directory domain -

An Active Directory domain

Every new Active Directory has the default tree structure shown above. Of pertinence here is the domain root object, which is root of the entire domain tree structure, and it has an access control list (ACL) that contains many access control entries (ACEs.)


Specifically, the following is the ACL of the domain root object -

Active Directory domain root object ACL

By default, the domain root ACL has a total of 53 ACEs in it, of which 26 are marked as Inheritable (CI) and as a result, these 26 ACEs will be inherited by all* child objects of the domain root, including any new objects created underneath the domain root, and all objects subsequently created underneath any such objects. For instance, if an organization was to create a new OU under the domain root, to serve as its main top-level OU, the ACL of the new OU will inherit these 26 ACEs from the domain root.

* These ACEs will be inherited by all objects in the domain, except those, whose ACL is marked Protected.


Now let us consider what happens when an organization creates a a new OU, say called Corp, to serve as its main top-level OU -

An Active Directory OU

This new Corp OU is an object of class organizationalUnit, and when it is created, the security descriptor specified in the value of the defaultSecurityDescriptor attribute on the Organizational-Unit classSchema object is made the NT Security Descriptor of this newly created OU. Inspecition of the Schema will reveal that there are a total of 9 ACEs in the ACL specified in the defaultSecurityDescriptor attribute for the Organizational-Unit object class in the Active Director Schema.

As a result, when this object is created, these 9 ACEs are reproduced in the ACL and in additon, the 26 ACEs marked inheritable on its parent object (the domain root object) are inherited by this object, resulting in a total of 35 ACEs in this new OU's ACL.

Note - Finally, (only) in the case of OUs, during creation, if the option Protect this object from accidental deletion is checked, the System automatically adds 1 additional ACE to the ACL, which is as follows - <Deny  Everyone  Delete,Delete Tree  This object only>


Consequently, in light of the note above, the ACL of the Corp OU will contain a total of 36 ACEs, of which 9 were reproduced from the defaultSecurityDescriptor, 26 were inherited from its parent, and 1 was added by the System (per the note above) .


In this manner, every object created in Active Directory, whether it be a domain user account, a domain computer account, a security group, an OU etc., is protected by an ACL, and the ACEs in its ACL are a combination of the ACEs specified in the defaultSecurityDescriptor attribute of the classSchema object that represents the class of object it is, and the set of ACEs that the object inherits from the ACL of its parent object (, which in turn has inherited ACEs from its parent object, and so on.)






A Closer Look at the Sources of Default Access

The following sections take a closer look at the 2 sources of default access in Active Directory, and they aid in understanding exactly what access is specified by default in an Active Directory domain, including where in Active Directory it is specified.


Note - NT Security Descriptor and Default Security Descriptor definitions below are provided in Security Descriptor Definition Language (SDDL) format. GUIDS are Schema ID GUIDS (for Schema Classes and Attributes), Attribute Security GUIDs (for Property Sets) or Rights GUIDs (for Control Access Rights).

  1. A closer look at the access provisioned by default inside the ACLs of some pertinent instantiated objects in a new Active Directory deployment -

    1. Domain Root

      NTSecurityDescriptor=O:DAG:DAD:(A;;RP;;;WD)(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;<SID of Enterprise Read-only Domain Controllers>)(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)(A;;RPLCLORC;;;AU)(A;;RPWPCRLCLOCCRCWDWOSW;;;DA)(A;CI;RPWPCRLCLOCCRCWDWOSDSW;;;BA)(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EA)(A;CI;LC;;;RU)(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;;RP;c7407360-20bf-11d0-a768-00aa006e0529;;RU)(OA;CIIO;RPLCLORC;;bf967a9c-0de6-11d0-a285-00aa003049e2;RU)(A;;RPRC;;;RU)(OA;CIIO;RPLCLORC;;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(A;;LCRPLORC;;;ED)(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;CIIO;RPLCLORC;;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;RU)(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;AU)(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;ED)(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;ED)(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;ED)(OA;CIIO;WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;PS)(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;DD)(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)(OA;;CR;e2a36dc9-ae17-47c3-b58b-be34c55ba633;;S-1-5-32-557)(OA;;CR;280f369c-67c7-438e-ae98-1d46f3c6f541;;AU)(OA;;CR;ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501;;AU)(OA;;CR;05c74c5e-4deb-43b4-bd9f-86664c2a7fd5;;AU)(OA;;CR;1131f6ae-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6ae-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;CIIO;CRRPWP;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)(OA;CIOI;RPWP;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;PS)(OA;CIIO;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;PS)(OA;CIIO;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;CO)S:(AU;SA;WDWOWP;;;WD)(AU;SA;CR;;;BA)(AU;SA;CR;;;DU)(OU;CISA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CISA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)


    2. Users Container

      nTSecurityDescriptor=O:DAG:DAD:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSW;;;DA)(OA;;CCDC;bf967aba-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967a9c-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)(A;;RPLCLORC;;;AU)(OA;;CCDC;4828CC14-1437-45bc-9B07-AD6F015E5F28;;AO)


    3. Computers Container

      nTSecurityDescriptor=O:DAG:DAD:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSW;;;DA)(OA;;CCDC;bf967a86-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967aba-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967a9c-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)(A;;RPLCLORC;;;AU)(OA;;CCDC;4828CC14-1437-45bc-9B07-AD6F015E5F28;;AO)


    4. Domain Controllers Container

      nTSecurityDescriptor=O:DAG:DAD:(A;;RPLCLORC;;;AU)(A;;RPWPCRLCLOCCRCWDWOSW;;;DA)(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)(A;;LCRPLORC;;;ED)S:(AU;SA;WDWOCCDCSDDT;;;WD)(AU;CISA;WP;;;WD)


    5. System Container

      nTSecurityDescriptor=O:DAG:DAD:(A;;RPLCLORC;;;AU)(A;;RPWPCRLCLOCCRCWDWOSW;;;DA)(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)


    6. AdminSDHolder Object

      nTSecurityDescriptor=O:DAG:DAD:P(A;;RPLCLORC;;;AU)(A;;RPWPCRLCLOCCDCRCWDWOSWSD;;;BA)(A;;RPWPCRLCLOCCDCRCWDWOSW;;;EA)(A;;RPWPCRLCLOCCDCRCWDWOSW;;;DA)(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;;RPLCLORC;;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;CA)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;;RPLCLORC;;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;WPRP;6db69a1c-9422-11d1-aebd-0000f80367c1;;S-1-5-32-561)(OA;;WPRP;5805bc62-bdc9-4428-a5e2-856a0f4c185e;;S-1-5-32-561)(OA;CI;CRRPWP;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)S:(AU;SA;WDWOWP;;;WD)


    7. NTDS Quotas Container

      nTSecurityDescriptor=O:DAG:DA D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPLCLORC;;;BA)(OA;;CR;4ecc03fe-ffc0-4947-b630-eb672a8a9dbc;;WD)S:(AU;CISA;WDWOSDDTWPCRCCDCSW;;;WD)


    8. Managed Service Accounts Container

      nTSecurityDescriptor=O:DAG:DAD:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSW;;;DA)(OA;;CCDC;ce206244-5827-4a86-ba1c-1c0c386c1b64;;AO)(OA;;CCDC;bf967aba-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967a9c-0de6-11d0-a285-00aa003049e2;;AO)(A;;RPLCLORC;;;AU)


    9. Keys Container

      nTSecurityDescriptor=O:DAD:P(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EA)(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;DA)(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;DD)(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;ED)(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;KA)(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EK)


    10. Policies Container

      nTSecurityDescriptor=O:DAG:DAD:(A;;RPLCLORC;;;AU)(A;;RPWPCRLCLOCCDCRCWDWOSW;;;DA)(A;;CC;;;PA)(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)S:(OU;SA;WDWOCCDCSDDT;f30e3bc2-9ff0-11d1-b603-0000f80367c1;;WD)(OU;CISA;WDWP;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)



  2. A closer look at the access specified in the default security descriptors of some commonly instantiated objects in the Active Directory Schema -

    1. Organizational Units

      defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(OA;;CCDC;bf967a86-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967aba-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967a9c-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)(A;;RPLCLORC;;;AU)(A;;LCRPLORC;;;ED)(OA;;CCDC;4828CC14-1437-45bc-9B07-AD6F015E5F28;;AO);


    2. Containers

      defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU);


    3. User Accounts

      defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPLCLORC;;;PS)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B2-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B3-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;RS)(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;RS)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;RS)(A;;RC;;;AU)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;AU)(OA;;RP;77B5B886-944A-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;E45795B3-9455-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;RS)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;CA)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;WPRP;6db69a1c-9422-11d1-aebd-0000f80367c1;;S-1-5-32-561)(OA;;WPRP;5805bc62-bdc9-4428-a5e2-856a0f4c185e;;S-1-5-32-561);


    4. Computer Accounts

      defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPCRLCLORCSDDT;;;CO)(OA;;WP;4c164200-20c0-11d0-a768-00aa006e0529;;CO)(A;;RPLCLORC;;;AU)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(A;;CCDC;;;PS)(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;CA)(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;PS)(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;PS)(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;CO)(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;CO)(OA;;WP;3e0abfd0-126a-11d0-a060-00aa006c33ed;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;WP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;WP;bf967950-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560);


    5. Security Groups

      defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPLCLORC;;;PS)(OA;;CR;ab721a55-1e2f-11d0-9819-00aa0040529b;;AU)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560);


    6. Foreign Security Principals

      defaultSecurityDescriptor: defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPLCLORC;;;PS)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B2-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B3-9455-11d1-AEBD-0000F80367C1;;PS)(A;;RC;;;AU)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;AU)(OA;;RP;77B5B886-944A-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;E45795B3-9455-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD);


    7. Group Policy Containers

      defaultSecurityDescriptor: D:P(A;CI;RPWPCCDCLCLOLORCWOWDSDDTSW;;;DA)(A;CI;RPWPCCDCLCLOLORCWOWDSDDTSW;;;EA)(A;CI;RPWPCCDCLCLOLORCWOWDSDDTSW;;;CO)(A;CI;RPWPCCDCLCLORCWOWDSDDTSW;;;SY)(A;CI;RPLCLORC;;;AU)(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;CI;LCRPLORC;;;ED);


    8. Group Managed Service Accounts

      defaultSecurityDescriptor: D:(OD;;CR;00299570-246d-11d0-a768-00aa006e0529;;WD)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPCRLCLORCSDDT;;;CO)(OA;;WP;4c164200-20c0-11d0-a768-00aa006e0529;;CO)(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;CO)(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;CO)(OA;;WP;3e0abfd0-126a-11d0-a060-00aa006c33ed;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;WP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;WP;bf967950-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;PS)(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;PS)(A;;RPLCLORC;;;AU)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;CA)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;RP;e362ed86-b728-0842-b27d-2dea7a9df218;;WD);


    9. Trusted Domain Objects

      defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)(OA;;WP;736e4812-af31-11d2-b7df-00805f48caeb;bf967ab8-0de6-11d0-a285-00aa003049e2;CO)(A;;SD;;;CO);




Default Access specified in Active Directory

The following is the default modify access specified in a new Active Directory domain, as a result of the 2 sources of default access in Active Directory, and it reveals that 20+ security principals are granted modify access in Active Directory by default -


Note - The following details are based on an examination of default security permissions in a Windows Server 2025 Active Directory domain. This does not include the Configuration or Schema partitions. By default, there are 244 objects in the domain partition of a new Active Directory (forest root) domain with one DC, and by default there are a total of 6704 ACEs inside the ACLs of these 244 objects. The analysis presented below was made possible using the ACL analysis and security permissions analysis capabilities of the Active Directory Permissions Analyzer and Active Directory ACL Analyzer and Exporter. tools

The security principals for whom modify access is specified in Active Directory by default are - Account Operators, Administrators, Cert Publishers, Cloneable Domain Controllers, Creator Owner, DnsAdmins, Domain Admins, Domain Computers, Domain Controllers, Enterprise Admins, Enterprise Domain Controllers, Enterprise Key Admins, Enterprise Read-only Domain Controllers, Everyone, Group Policy Creator Owners, Incoming Forest Trust Builders, Key Admins, Pre-Windows 2000 Compatible Access, Print Operators, RAS and IAS Servers, Self, System and Terminal Server License Servers.



  1. Account Operators

    1. Full Control on all User, Group and Computer objects, except those protected by AdminSDHolder
    2. Full Control on all foreign security principals in the ForeignSecurityPrincipals container (cn=ForeignSecurityPrincipals,dc=<domain>).
    3. Create Child, Delete Child – <Computer, User, Group, inetOrgPerson> on all Containers and OUs in the domain.
    4. Create Child, Delete Child – <User, Group, ms-DS-Managed-Service-Account> on the Managed Service Accounts container.

  2. Administrators

    1. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Delete, Create Child, Extended Right, Validated Write, Read Property, Write Property [This object and all child objects] on the domain root.
    2. Extended Right – <Replicating Directory Changes, Replicating Directory Changes in Filtered Set, Replicating Directory Changes All, Replication Synchronization, Manage Replication Topology, Read Only Replication Secret Synchronization> on the domain root.
    3. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Delete, Create Child, Extended Right, Validated Write, Read Property, Write Property [This object and all child objects] on the Builtin container (cn=builtin,dc=<domain>)
    4. Extended Right – <Replicating Directory Changes, Replicating Directory Changes in Filtered Set, Replicating Directory Changes All, Replication Synchronization, Manage Replication Topology, Read Only Replication Secret Synchronization> on the Builtin container (cn=builtin,dc=<domain>)
    5. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Delete, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the AdminSDHolder object (cn=AdminSDHolder,cn=System,dc=<domain>).
    6. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Delete, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on all accounts and groups protected by AdminSDHolder
    7. Read Control, List Child, List Object, Create Child, Validated Write, Read Property, Write Property [This object and all child objects] on the WMIPolicy container (WMIPolicy,cn=System,dc=<domain>).
    8. Read Control, List Child, List Object, Create Child, Validated Write, Read Property, Write Property [This object and all child objects] on the SOM container (cn=SOM,cn=WMIPolicy,cn=System,dc=<domain>).
    9. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Delete, Create Child, Extended Right, Validated Write, Read Property, Write Property [This object and all child objects] on the VolumeTable object (cn=VolumeTable,cn=FileLinks,cn=System,dc=<domain>).

  3. Cert Publishers

    1. Read Property, Write Property – <X509-Cert> on all User, Group and Computer objects, including those protected by AdminSDHolder.
    2. Read Property, Write Property – <X509-Cert> on the AdminSDHolder object (cn=AdminSDHolder,cn=System,dc=<domain>).

  4. Cloneable Domain Controllers

    1. Extended Right – <Allow a DC to create a clone of itself> on the domain root.

  5. Creator Owner

    1. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Delete, Delete Tree, Create Child, Delete Child, Validated Write, Read Property, Write Property [ Inherit Only: Applies to All child objects] on all Group Policy Containers.
    2. Validated Write – <Validated write to computer attributes> [ Inherit Only: Applies to Computer objects] on the Builtin container (cn=builtin,dc=<domain>).
    3. Validated Write – <Validated write to computer attributes> [ Inherit Only: Applies to Computer objects] on the domain root.
    4. Full Control [ Inherit Only: Applies to Computer objects] on the WMIPolicy container (cn=WMIPolicy,cn=System,dc=<domain>).
    5. Full Control [ Inherit Only: Applies to Computer objects] on the SOM container (cn=SOM,cn=WMIPolicy,cn=System,dc=<domain>).

  6. DnsAdmins

    1. Read Control, List Child, Modify Owner, Modify Permissions, Delete, Delete Tree, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property [This object and all child objects] on the MicrosoftDNS container.

  7. Domain Admins

    1. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Extended Right, Validated Write, Read Property, Write Property on the domain root.

      2. + on all top-level objects (i.e. immediate child objects of the domain root) -

    2. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Extended Right, Validated Write, Read Property, Write Property on the Builtin container (cn=builtin,dc=<domain>).
    3. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the AdminSDHolder object (cn=AdminSDHolder,cn=System,dc=<domain>).
    4. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the Computers container (cn=Computers,dc=<domain>).
    5. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the Domain Controllers OU (ou=Domain Controllers,dc=<domain>).

      6. + On all domain computer objects representing DCs (i.e. immediate child objects of the Domain Controllers OU) -

    6. Write Property – <Logon Information> [Applies to Computer objects ].
    7. Write Property – <Description> [Applies to Computer objects ].
    8. Write Property – <Display-Name> [Applies to Computer objects ].
    9. Write Property – <SAM-Account-Name> [Applies to Computer objects ].
    10. Write Property – <Account Restrictions> [Applies to Computer objects ].
    11. Read Control, List Child, List Object, Delete, Delete Tree, Extended Right, Read Property.
    12. Full Control
    13. Full Control on the Foreign Security Principals container (cn=Foreign Security Principals,dc=<domain>).
    14. Full Control on all foreign security principal objects in the Foreign Security Principals container.
    15. Full Control on the Keys container (cn=Keys,dc=<domain>).
    16. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the LostAndFound container (cn=LostAndFound,dc=<domain>).
    17. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the Managed Service Accounts container (cn=Managed Service Accounts,dc=<domain>).
    18. Full Control on the Program Data container (cn=Program Data,dc=<domain>).
    19. Full Control on the Microsoft container in the Program Data container.
    20. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the Users container (cn=Users,dc=<domain>).

    21. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Extended Right, Validated Write, Read Property, Write Property on the System container (cn=System,dc=<domain>).

      22. + On objects in the System container (i.e. immediate child objects of the System container) -

    22. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the AdminSDHolder object (cn=AdminSDHolder,cn=System,dc=<domain>).
    23. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the ComPartitions object (cn=ComPartitions,cn=System,dc=<domain>).
    24. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the ComPartitionSets object (cn=ComPartitionSets,cn=System,dc=<domain>).
    25. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the Default Domain Policy object (cn=Default Domain Policy,cn=System,dc=<domain>).
    26. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the Dfs-Configuration object (cn=Dfs-Configuration,cn=System,dc=<domain>).
    27. Full Control on the DFSR-GlobalSettings container (cn=DFSR-GlobalSettings,cn=System,dc=<domain>).
    28. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the DomainUpdates object (cn=DomainUpdates,cn=System,dc=<domain>).
    29. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the File Replication Service object (cn=File Replication Service,cn=System,dc=<domain>).
    30. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the File Links object (cn=File Links,cn=System,dc=<domain>).
    31. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the IP Security object (cn=IP Security,cn=System,dc=<domain>).
    32. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the Meetings object (cn=Meetings,cn=System,dc=<domain>).
    33. Full Control on the MicrosoftDNS container (cn=MicrosoftDNS,cn=System,dc=<domain>).
    34. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the Password Settings Container object (cn=Password Settings Container,cn=System,dc=<domain>).
    35. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the Policies object (cn=Policies,cn=System,dc=<domain>).
    36. Full Control on the PSPs container (cn=PSPs,cn=System,dc=<domain>).
    37. None on the RAS and IAS Servers Check container (cn=RAS and IAS Servers Check,cn=System,dc=<domain>).
    38. Full Control on the RID Manager$ container (cn=RID Manager$,cn=System,dc=<domain>).
    39. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the RpcServices object (cn=RpcServices,cn=System,dc=<domain>).
    40. Full Control on the Server container (cn=Server,cn=System,dc=<domain>).
    41. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the WinsockServices object (cn=WinsockServices,cn=System,dc=<domain>).
    42. Full Control on the WMIPolicy container (cn=WMIPolicy,cn=System,dc=<domain>).


      43. Note - In addition to the above, there are numerous security permissions specified for Domain Admins on various objects that are instantiated within the various containers listed above, such as on objects of class ipsecFilter, ipsecISAKMPolicy, ipsecNegotiationPolicy, ipsecNFA, ipsecPolicy, dnsZone, dnsNode, groupPolicyContainer, Container etc. and many others, and detailed listings of the specific security permissions granted to Domain Admins on instances of all such objects, while easily possible, are not substantially constructive or beneficial to be taking a closer look at.


    43. Full Control on the NTDS Quotas container (cn=NTDS Quotas,dc=<domain>).
    44. Full Control on the TPM Devices container (cn=TPM Devices,dc=<domain>).
    45. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the Infrastructure object (cn=Infrastructure,dc=<domain>).

      46. +

    46. Full Control on all domain user accounts, computer objects and security groups created in the domain.

  8. Domain Computers

    1. List Child, List Object, Create Child, Read Property on the TPM Devices container (cn=TPM Devices,dc=<domain>).

  9. Domain Controllers

    1. Extended Right – <Replicating Directory Changes All> on the domain root.
    2. Extended Right – <Replicating Directory Changes All> on the Builtin container (cn=builtin,dc=<domain>).
    3. Full Control [This object and all child objects] on the Keys container (cn=Keys,dc=<domain>)

  10. Enterprise Admins

    1. Full Control [This object and all child objects] on the domain root.
    2. Full Control [This object and all child objects] on the Builtin container (cn=builtin,dc=<domain>).
    3. Full Control [This object and all child objects] on the Keys container (cn=Keys,dc=<domain>)..
    4. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the AdminSDHolder object (cn=AdminSDHolder,cn=System,dc=<domain>).
    5. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on all accounts and groups protected by AdminSDHolder.
    6. Read Control, List Child, List Object, Create Child, Validated Write, Read Property, Write Property [This object and all child objects] on the WMIPolicy container (WMIPolicy,cn=System,dc=<domain>).
    7. Read Control, List Child, List Object, Create Child, Validated Write, Read Property, Write Property [This object and all child objects] on the SOM container (cn=SOM,cn=WMIPolicy,cn=System,dc=<domain>).
    8. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Delete, Create Child, Extended Right, Validated Write, Read Property, Write Property [This object and all child objects] on the VolumeTable object (cn=VolumeTable,cn=FileLinks,cn=System,dc=<domain>).
    9. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create Child, Validated Write, Read Property, Write Property [This object only] on objects of class Group-Policy-Container.
    10. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Delete, Delete Tree, Create Child, Delete Child, Validated Write, Read Property, Write Property [All child pbjects] on objects of class Group-Policy-Container.

  11. Enterprise Domain Controllers [ Well-Known Security Principal ]

    1. Extended Right – <Replicating Directory Changes, Replicating Directory Changes in Filtered Set, Replication Synchronization, Manage Replication Topology, Read Only Replication Secret Synchronization> on the domain root.
    2. Extended Right – <Replicating Directory Changes, Replicating Directory Changes in Filtered Set, Replication Synchronization, Manage Replication Topology, Read Only Replication Secret Synchronization> on the Builtin container (cn=builtin,dc=<domain>).
    3. Full Control [This object and all child objects] on the Keys container (cn=Keys,dc=<domain>)
    4. Read Control, List Child, Modify Owner, Modify Permissions, Delete, Delete Tree, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the MicrosoftDNS container (in the System container.)
    5. Read Control, List Child, Modify Owner, Modify Permissions, Delete, Delete Tree, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property [This object and all child objects] on all objects of class Dns-Zone.
    6. Full Control on all objects of class Dns-Node.

  12. Enterprise Key Admins

    1. Read Property, Write Property – <ms-DS-Key-Credential-Link> [This object and all child objects] on the domain root.
    2. Full Control [This object and all child objects] on the Keys container (cn=Keys,dc=<domain>)

  13. Enterprise Read-only Domain Controllers

    1. Extended Right – <Replicating Directory Changes> on the domain root.
    2. Extended Right – <Replicating Directory Changes> on the Builtin container (cn=builtin,dc=<domain>).

  14. Everyone

    1. Extended Right – <Change Password> on all User and Computer objects.
    2. Extended Right – <Change Password> on the AdminSDHolder object (cn=AdminSDHolder,cn=System,dc=<domain>).
    3. Extended Right – <Change Password> on all foreign security principals in the ForeignSecurityPrincipals container (cn=ForeignSecurityPrincipals,dc=<domain>).
    4. Deny Delete Child on the domain root.

  15. Group Policy Creator Owners

    1. Create Child on the Policies container (cn=Policies,cn=System,dc=<domain>).
    2. Read Control, List Child, List Object, Create Child, Validated Write, Read Property, Write Property on the WMIPolicy container (cn=WMIPolicy,cn=System,dc=<domain>).
    3. Create Child on the WMIGPO container (cn=WMIGPO,cn=WMIPolicy,cn=System,dc=<domain>).
    4. Create Child on the PolicyType container (cn=PolicyType,cn=WMIPolicy,cn=System,dc=<domain>).
    5. Read Control, List Child, List Object, Create Child, Validated Write, Read Property, Write Property on the SOM container (cn=SOM,cn=WMIPolicy,cn=System,dc=<domain>).

  16. Incoming Forest Trust Builders

    1. Extended Right – <Create Inbound Forest Trust> on the domain root.
    2. Extended Right – <Create Inbound Forest Trust> on the Builtin container (cn=builtin,dc=<domain>)

  17. Key Admins

    1. Read Property, Write Property – <ms-DS-Key-Credential-Link> [This object and all child objects] on the domain root.
    2. Full Control [This object and all child objects] on the Keys container (cn=Keys,dc=<domain>)

  18. Pre-Windows 2000 Compatible Access

    1. Extended Right – <Enumerate Entire SAM Domain> on the SAM Server object (cn=Server,cn=System,dc=<domain>) .

  19. Print Operators

    1. Create Child, Delete Child – <Print-Queue> on the Computers container (cn=computers,dc=<domain>).
    2. Create Child, Delete Child – <Print-Queue> on the Users container (cn=users,dc=<domain>).
    3. Create Child, Delete Child – <Print-Queue> on all existing domain controller computers accounts.

  20. RAS and IAS Servers

    1. Read Control, List Child, List Object, Modify Owner, Modify Permissions, Delete, Create Child, Delete Child, Extended Right, Validated Write, Read Property, Write Property on the RAS and IAS Servers Access Check container (cn=RAS and IAS Servers Access Check,cn=System,dc=<domain>).

  21. Self

    1. Validated Write – <Validated write to computer attribute> [ Inherit Only: Applies to Computer objects] on the domain root.
    2. Write Property – <TPM-TpmInformationForComputer> [ Inherit Only: Applies to Computer objects] on the domain root.
    3. Read Property, Write Property – <ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity> [ This object and all child objects] on the domain root.
    4. Extended Right, Read Property, Write Property – <Private Information > [ Inherit Only: Applies to All child objects] on the domain root.
    5. Validated Write – <Validated write to computer attribute> [ Inherit Only: Applies to Computer objects] on the Builtin container (cn=builtin,dc=<domain>).
    6. Write Property – <TPM-TpmInformationForComputer> [ Inherit Only: Applies to Computer objects] on the Builtin container (cn=builtin,dc=<domain>).
    7. Read Property, Write Property – <ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity> [ This object and all child objects] on the Builtin container (cn=builtin,dc=<domain>).
    8. Extended Right, Read Property, Write Property – <Private Information > [ Inherit Only: Applies to All child objects] on the Builtin container (cn=builtin,dc=<domain>).
    9. Extended Right – <Change Password> on the AdminSDHolder object (cn=AdminSDHolder,cn=System,dc=<domain>).
    10. Extended Right, Read Property, Write Property – <Private Information > [ This object and all child objects] on the AdminSDHolder object (cn=AdminSDHolder,cn=System,dc=<domain>).
    11. Extended Right – <Change password> on all user objects.
    12. Extended Right – <Send As> on all user objects.
    13. Extended Right – <Receive As> on all user objects.
    14. Read Property, Write Property – <Personal Information> on all user objects.
    15. Read Property, Write Property – <Phone and Mail Options> on all user objects.
    16. Read Property, Write Property – <Web Information> on all user objects.
    17. Validated Write – <Validated write to DNS host name> on all computer objects.
    18. Validated Write – <Validated write to service principal name> on all computer objects.
    19. Read Property, Write Property – <Personal Information> on all computer objects.
    20. Create Child, Delete Child on all computer objects.
    21. Write Property – <ms-LAPS-Password> [ Inherit Only: Applies to Computer objects] on all OUs in the domain.
    22. Read Property, Write Property – <ms-LAPS-PasswordExpirationTime> [ Inherit Only: Applies to Computer objects] on all OUs in the domain.
    23. Read Property, Write Property – <ms-LAPS-Encrypted-Password-Attributes> [ Inherit Only: Applies to Computer objects] on all OUs in the domain.
    24. Extended Right – <Change password> on all foreign security principals in the ForeignSecurityPrincipals container (cn=ForeignSecurityPrincipals,dc=<domain>).
    25. Extended Right – <Send As> on all foreign security principals in the ForeignSecurityPrincipals container (cn=ForeignSecurityPrincipals,dc=<domain>).
    26. Extended Right – <Receive As> on all foreign security principals in the ForeignSecurityPrincipals container (cn=ForeignSecurityPrincipals,dc=<domain>).
    27. Read Property, Write Property – <Personal Information> on all foreign security principals in the ForeignSecurityPrincipals container (cn=ForeignSecurityPrincipals,dc=<domain>).
    28. Read Property, Write Property – <Phone and Mail Options> on all foreign security principals in the ForeignSecurityPrincipals container (cn=ForeignSecurityPrincipals,dc=<domain>).
    29. Read Property, Write Property – <Web Information> on all foreign security principals in the ForeignSecurityPrincipals container (cn=ForeignSecurityPrincipals,dc=<domain>).
    30. Validated Write – <Validated write to DNS host name> on all msDS-Group-Managed-Service-Account objects.
    31. Validated Write – <Validated write to service principal name> on all msDS-Group-Managed-Service-Account objects.
    32. Read Property, Write Property – <Personal Information> on all msDS-Group-Managed-Service-Account objects.

  22. System

    1. Full Control [Explicit] on all objects in the domain

  23. Terminal Server License Servers

    1. Read Property, Write Property – <Terminal Server> on the AdminSDHolder object (cn=AdminSDHolder,cn=System,dc=<domain>).
    2. Read Property, Write Property – <Terminal Server License Server> on the AdminSDHolder object (cn=AdminSDHolder,cn=System,dc=<domain>).
    3. Read Property, Write Property – <Terminal Server> on the Administrator account (cn=Administrator,cn=Users,dc=<domain>).
    4. Read Property, Write Property – <Terminal Server License Server> on the Administrator account (cn=Administrator,cn=Users,dc=<domain>).
    5. Read Property, Write Property – <Terminal Server> on the krbtgt account (cn=krbtgt,cn=Users,dc=<domain>).
    6. Read Property, Write Property – <Terminal Server License Server> on the krbtgt account (cn=krbtgt,cn=Users,dc=<domain>).
    7. Read Property, Write Property – <Terminal Server> on the Guest account (cn=Guest,cn=Users,dc=<domain>).
    8. Read Property, Write Property – <Terminal Server License Server> on the Guest account (cn=Guest,cn=Users,dc=<domain>).



Important Side-Note

– Begin Sidenote –

In addition to the above, one other factor, i.e. the default User Rights assignment in the default Domain Controllers Security Policy in Active Directory, also has a(n indirect) bearing on the default access in Active Directory.

Specifically, consider the following default User Rights assignments -

  1. Allow logon locally - Account Operators, Administrators, Backup Operators, Enterprise Domain Controllers, Print Operators, Server Operators
  2. Backup files and directories - Administrators, Backup Operators, Server Operators
  3. Restore files and directories - Administrators, Backup Operators, Server Operators
  4. Enable computer and user accounts to be trusted for delegation - Administrators
  5. Take ownership of files or other objects - Administrators

         User right 5 above can be used to directly gain command and control (C2) over Active Directory. User rights 2 (along with 1), 3 (also along with 1) and 4 can be used to indirectly gain C2 over Active Directory.


 🞂 Key Takeaway - The Administrators group is the most powerful group in Active Directory, primarily due to default assignment of user right 5 (above). Specifically, due to this user-right, any member of the Administrators group can take ownership of any object in Active Directory, including those of the domain root object, the AdminSDHolder object and all objects representing all administrative (privileged) accounts (e.g. Administrator) and groups (e.g. Domain Admins) in Active Directory.

– End Sidenote –



In summary, the net resulting default access in Active Directory is a combination of the pre-configured access stamped during the initial creation of objects in Active Directory and the access specified in the default security descriptors in the Schema, and as such there are 244 objects in a new Active Directory domain and in the ACLs of these 244 objects reside a total of 6704 ACEs, and together they specify the default access in Active Directory, which translates to 23 security principals having modify access.