Permissions Inheritance

[meastaugh1]

I've created a new OU under the root of the domain, in which to store some contacts I only want certain users to be able to access.

 

I changed the NTFS permissions of the OU to stop inheriting permissions from the parent. Then removed entries such as Authenticated Users - Read. However, when I create a new contact in the OU, it still gets an ACE for Authenticated Users - Read.

 

I assume this entry is coming from some default ACL, but I don't know where?

 

thanks

[Geoff]

The domain controller. It's preventing you from breaking Active directory.

[djm968]

You could try adding the deny permission for the other security group

[meastaugh1]

The domain controller. It's preventing you from breaking Active directory.

 

I can manually remove the ACEs that are allocated to the objects by default, so why can I not specify this at the OU level?

 

You could try adding the deny permission for the other security group

 

That's probably do-able, but I'd rather just allocate access to users who need it, rather than allocate to everyone then try to stop access.

 

thanks

[Geoff]

I can manually remove the ACEs that are allocated to the objects by default, so why can I not specify this at the OU level?

 

While it (barely) makes sense to prevent AD objects from being replicated by removing read permissions from them. Preventing replication of an entire OU will cause the ntfrs service to generate replication errors.

[meastaugh1]

I can manually remove the ACEs that are allocated to the objects by default, so why can I not specify this at the OU level?

 

While it (barely) makes sense to prevent AD objects from being replicated by removing read permissions from them. Preventing replication of an entire OU will cause the ntfrs service to generate replication errors.

 

My understanding was that FRS operated in the system context, is that not the case? I've found that objects without Authenticated Users-Read still replicate fine.

[Geoff]

No it operates as the Network Service user. System has no access to the network.

[ajbritton]

System has no access to the network.

 

Not quite true, System has at least ANONYMOUS access to the network, if not EVERYONE.

[meastaugh1]

My test contact has the following permissions set:

Administrators: All but full control

Domain and Enterprise Admins: Full Control

Exchange Enterprise Servers: Special

System: Full Control

 

This object was replicated across the 3 DCs fine. Should that not be working then?

[Geoff]

You gave Enterprise Admins Full Control.

[meastaugh1]

Ok, I removed all entries from my test contact's ACL except an administrator user, it still replicated changes made to the contact.