Schema vs. Enterprise vs. Domain Admin

Written by on Wednesday, February 27, 2008 4:18 - 0 Comments

Domain admins can basically do anything, anywhere in the forest.

You have to choose who will be your domain admins very carefully, even in a multi-domain environment. That’s because there are exploits that can enable Domain Admins to make themselves into Enterprise Admins or even Schema Admins! And this works even if you are a Domain Admin in a child domain! What this means that if you need true separation of admin powers, you need to deploy multiple forests. That’s because the forest is the only real security boundary in Active Directory. Domains are not true security boundaries. And this is also reason that Microsoft has stopped promoting the idea of an empty forest root domain where only Enterprise Admins reside, since these exploits can enable a Domain Admin in a child domain to easily become an Enterprise Admin and own the forest. ')}

Article written by

Leave a Reply

You must be logged in to post a comment.

2003 server - Sep 30, 2008 22:34 - 0 Comments

instant messaging srv records

More In Computers & PC

Microsoft Outlook - Mar 22, 2009 11:22 - 0 Comments

Outlook: Duplicates in Mailbox

More In Computers & PC