AdminSDHolder

AdminSDHolder protection in Active Directory refers to a protection mechanism in Active Directory wherein all domain accounts and groups considered to be administrative in nature by Active Directory are protected by a special security descriptor.

How it works

A special background process (SDProp) that runs periodically on the Domain Controller that has the PDC Emulator role, checks and applies a specific security descriptor onto all Active Directory objects representing admin accounts and groups in Active Directory. The specific security descriptor that is applied is the actual NT security descriptor of the AdminSDHolder object, which is located in the System container (CN=AdminSDHolder,CN=System,DC=DomainName) of the domain directory partition.

Protected Security Principals

This protection mechanism is designed to and thus protects the default Administrator account, the krbtgt account as well as all members of the following 13 security groups in Active Directory -

Account Operators, Administrators, Backup Operators, Domain Admins, Domain Controllers, Enterprise Admins, Enterprise Key Admins, Key Admins, Print Operators, Read-only Domain Controllers, Replicator, Schema Admins, Server Operators

Note - For additional information about these security groups, refer to Default Accounts and Groups in Active Directory and/or Privileged Access in Active Directory.

Security Permissions

The ACL in the NTSecurityDescriptor of the AdminSDHolder object is marked Protected and contains the following 24 access control entries (ACEs) that individually specify various Active Directory Security Permissions to various security principals -

#	Principal .	Type .	Access .	Applies To .
1	Pre-Windows 2000 Compatible Access	Allow	Read Property – Account Restrictions	inetOrgPerson objects
2	Pre-Windows 2000 Compatible Access	Allow	Read Property – Account Restrictions	User objects
3	Pre-Windows 2000 Compatible Access	Allow	Read Property – Logon Information	inetOrgPerson objects
4	Pre-Windows 2000 Compatible Access	Allow	Read Property – Logon Information	User objects
5	Pre-Windows 2000 Compatible Access	Allow	Read Property – Group Membership	inetOrgPerson objects
6	Pre-Windows 2000 Compatible Access	Allow	Read Property – Group Membership	User objects
7	Pre-Windows 2000 Compatible Access	Allow	Read Property – General Information	inetOrgPerson objects
8	Pre-Windows 2000 Compatible Access	Allow	Read Property – General Information	User objects
9	Pre-Windows 2000 Compatible Access	Allow	Read Property – Remote Access Information	inetOrgPerson objects
10	Pre-Windows 2000 Compatible Access	Allow	Read Property – Remote Access Information	User objects
11	Cert Publishers	Allow	Read Property, Write Property	This object only
12	Windows Authorization Access Group	Allow	Read Property – Token-Groups-Global-And-Universal	This object only
13	Terminal Server License Servers	Allow	Read Property, Write Property – Terminal-Server	This object only
14	Terminal Server License Servers	Allow	Read Property, Write Property – Terminal Server License Server	This object only
15	Pre-Windows 2000 Compatible Access	Allow	Read Control, List Child, List Object, Read Property	inetOrgPerson objects
16	Pre-Windows 2000 Compatible Access	Allow	Read Control, List Child, List Object, Read Property	User objects
17	Everyone	Allow	Change Password	This object only
18	Self	Allow	Change Password	This object only
19	Self	Allow	All Extended Rights, Read Property, Write Property – Private Information	This object only
20	Domain Admins	Allow	Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create all child objects, Delete all child objects, All Extended Rights, All Validated Writes, Read All Properties, Write All Properties	This object only
21	Enterprise Admins	Allow	Read Control, List Child, List Object, Modify Owner, Modify Permissions, Create all child objects, Delete all child objects, All Extended Rights, All Validated Writes, Read All Properties, Write All Properties	This object only
22	Administrators	Allow	Read Control, List Child, List Object, Modify Owner, Modify Permissions, Standard Delete, Create all child objects, Delete all child objects, All Extended Rights, All Validated Writes, Read All Properties, Write All Properties	This object only
23	Authenticated Users	Allow	Read Control, List Child, List Object, Read Property	This object only
24	System	Allow	Full Control	This object only

Observations

A simple analysis of the ACL in the NTSecurityDescriptor of the AdminSDHolder object reveals the following -

There are a total of 24 access control entries (ACEs) in the ACL and together they specify access for 11 security principals.
Of these 24 ACEs, 12 ACEs specify access for the Pre-Windows 2000 Compatible Access group, all of which is read access.
Of these 11 security principals from whom access is specified, 3 have limited modify access and 3 have broad modify access.
Limited modify access is specified for the following security principals -
1. Self – All Extended Rights + Write Property to Private Information
2. Cert Publishers – Write Property permissions to modify the X509-Cert attribute
3. Terminal Server License Servers – Write Property permissions to modify the Terminal-Server and Terminal Server License Server property sets
Broad modify access is specified for the following security principals -
1. Administrators – One permission short of Full Control. i.e. Full Control minus Delete Tree
2. Domain Admins – Two permissions short of Full Control. i.e. Full Control minus Standard Delete and Delete Tree
3. Enterprise Admins – Two permissions short of Full Control. i.e. Full Control minus Standard Delete and Delete Tree
Of special note is the permission granting All Extended Rights to the Self trustee, because when duplicated on a security group, it will in effect allow all members of the security group to remove their own accounts from the security group.

An Important Note

The security permissions specified in the ACL of the AdminSDHolder object are merely individual authorization intent specifications. They do not impact the final resulting access in isolation, but in fact do so collectively, and consequently when trying to determine who has what access on all protected accounts and groups, what matters and thus what needs to be determined is who has what Active Directory Effective Permissions on each individual admin account and group that this ACL is stamped on.