{"id":3346,"date":"2017-04-05T09:16:22","date_gmt":"2017-04-05T05:16:22","guid":{"rendered":"https:\/\/rakhesh.com\/?p=3346"},"modified":"2017-04-11T12:50:37","modified_gmt":"2017-04-11T08:50:37","slug":"ou-delegation-not-working-contd-finding-protected-groups","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/ou-delegation-not-working-contd-finding-protected-groups\/","title":{"rendered":"OU delegation not working (contd.) &#8211; finding protected groups"},"content":{"rendered":"<p>Turns out I was\u00a0mistaken in my <a href=\"https:\/\/rakhesh.com\/powershell\/ou-delegation-not-working\/\">previous post<\/a>. A few minutes after enabling inheritance, I noticed it was disabled again. So that means the groups must be protected by AD.<\/p>\n<p>I knew of the <code>AdminSDHolder<\/code> object and how it provides a template set of permissions that are applied to protected accounts (i.e. members of groups that are protected). I also knew that there were some groups that are <a href=\"https:\/\/technet.microsoft.com\/en-us\/windows-server-docs\/identity\/ad-ds\/plan\/security-best-practices\/appendix-c--protected-accounts-and-groups-in-active-directory\">protected by default<\/a>. What I didn&#8217;t know, however, what that the defaults can be changed.\u00a0<\/p>\n<p>Initially I did a\u00a0<code>Compare-Object -ReferenceObject (Get-ADPrincipalGroupMembership User1) -DifferenceObject (Get-ADPrincipalGroupMembership User2) -IncludeEqual<\/code> to compare the memberships of two random accounts that seemed to be protected. These were accounts with totally different roles &amp; group memberships so the idea was to see if they had any common groups (<em>none!<\/em>) and failing that to see if the groups they were in had any common ancestors (<em>none again!<\/em>)<\/p>\n<p>Then I Googled a bit :o) and came across a solution.\u00a0<\/p>\n<p>Before moving on to that though, as a note to myself:\u00a0<\/p>\n<ul>\n<li>The <code>AdminSDHolder<\/code> object is at\u00a0<code>CN=AdminSDHolder,CN=System,<span style=\"text-decoration: underline;\">DC=domain,DC=com<\/span><\/code>. Find that via ADSI Edit (replace the domain part accordingly).\u00a0<\/li>\n<li>Right click the object and its Security tab lists the template permissions that will be applied to members of protected groups. You can make changes here.\u00a0<\/li>\n<li>SDProp is a process that runs every 60 minutes on the DC holding the PDC Emulator role. The period can be changed via the registry key\u00a0<code>HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters\\AdminSDProtectFrequency<\/code>. (If it doesn&#8217;t exist, add it. DWORD).\u00a0<\/li>\n<li>SDProp can be <a href=\"https:\/\/technet.microsoft.com\/en-us\/windows-server-docs\/identity\/ad-ds\/plan\/security-best-practices\/appendix-c--protected-accounts-and-groups-in-active-directory\">run manually<\/a> if required.\u00a0<\/li>\n<\/ul>\n<p>So back to my issue. Turns out if a group as its <code>adminCount<\/code> <a href=\"https:\/\/social.technet.microsoft.com\/wiki\/contents\/articles\/22331.adminsdholder-protected-groups-and-security-descriptor-propagator.aspx\">attribute set to 1 then it will be protected<\/a>. So I ran the following against the OU containing my admin \u00a0account groups:<\/p>\n<pre class=\"lang:ps decode:true \">Get-ADGroup -SearchBase \"OU=Admin Accounts,DC=domain,DC=com\" -Filter 'adminCount -eq 1' | ft Name<\/pre>\n<p>Bingo! Most of my admin\u00a0groups were protected, so most admin accounts were protected. All I have to do now is either un-protect these groups (my preferred solution), or change the template\u00a0to delegate permissions there.\u00a0<\/p>\n<p><strong>Update<\/strong>: Simply un-protecting a group does not un-protect all its members (<a href=\"https:\/\/blogs.technet.microsoft.com\/askds\/2009\/05\/07\/five-common-questions-about-adminsdholder-and-sdprop\/\">this is by design<\/a>). The member objects too have their <code>adminCount<\/code> attribute set to 1, so apart from fun-protecting the groups we must un-protect the members too.\u00a0<\/p>\n<pre class=\"lang:ps decode:true \">Get-ADGroup -SearchBase \"OU=Admin Accounts,DC=myDomain,DC=com\" -Filter 'adminCount -eq 1' | Set-ADGroup -Clear adminCount\r\n\r\nGet-ADUser -SearchBase \"OU=Admin Accounts,DC=myDomain,DC=com\" -Filter 'adminCount -eq 1' | Set-ADUser -Clear adminCount<\/pre>\n<p><strong>Update 2<\/strong>: Found this good <a href=\"https:\/\/blogs.technet.microsoft.com\/lrobins\/2011\/06\/23\/admin-free-active-directory-and-windows-part-2-protected-accounts-and-groups-in-active-directory\/\">post<\/a> with lots more details. How to run the process manually, what are the default protected groups, etc. Read that post in conjunction with <a href=\"http:\/\/www.selfadsi.org\/extended-ad\/ad-permissions-adminsdholder.htm\">this one<\/a> and you are set!<\/p>\n<p><strong>Update 3: <\/strong>You can unprotect the following default groups <a href=\"http:\/\/www.selfadsi.org\/extended-ad\/ad-permissions-adminsdholder.htm\">via <code>dsHeuristics<\/code><\/a>: 1) Account Operators, 2) Backup Operators, 3) Server Operators, 4) Print Operators. But that still leaves groups such as Administrators (built-in), Domain Admins, Enterprise Admins, Domain Controllers, Schema Admins, Read-Only Domain Controllers, and the user Administrator (built-in). There&#8217;s no way to un-protect members of these.<\/p>\n<p>Something I hadn&#8217;t realized about <code>adminCount<\/code>. This attribute does not mean a group\/ user <em>will be<\/em> protected. Instead, what it means is that if a group\/ user is protected, and its ACLs have changed and are now reset to default, then the <code>adminCount<\/code> attribute will be set. So yes, <code>adminCount<\/code> will let you find groups\/ users that are protected; but merely setting <code>adminCount<\/code> on a group\/ user does not protect it. I learnt this the hard way while I was testing my changes. Set <code>adminCount<\/code> to 1 for a group and saw that nothing was happening.<\/p>\n<p>Also, it is possible that a protected user\/ group does not have <code>adminCount<\/code> set. This is because <code>adminCount<\/code> is <span style=\"text-decoration: underline;\">only set if there is a difference<\/span> in the ACLs between the user\/ group and the AdminSDHolder object. If there&#8217;s no difference, a protected object will not have the adminCount attribute set. :)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Turns out I was\u00a0mistaken in my previous post. A few minutes after enabling inheritance, I noticed it was disabled again. So that means the groups must be protected by AD. I knew of the AdminSDHolder object and how it provides a template set of permissions that are applied to protected accounts (i.e. members of groups &hellip; <a href=\"https:\/\/rakhesh.com\/windows\/ou-delegation-not-working-contd-finding-protected-groups\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">OU delegation not working (contd.) &#8211; finding protected groups<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[85],"tags":[4,698,140,696,697,699,227],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/3346"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=3346"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/3346\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=3346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=3346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=3346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}