when you say " if the SD of one of those objects is not the same as what is on the adminSDHolder object...", where on the adminSDHolder object are these values kept that help it determine the SD?
Thanks
On 3/17/06, joe <[EMAIL PROTECTED]> wrote:
The SDPROP thread monitors groups/users that are considered "sensitive" and if the SD of one of those objects is not the same as what is on the adminSDHolder object, that SD is applied to the object. They are not specified in the ACL on the adminSDHolder object because they shouldn't have permissions over those sensitive objects.
From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Tom Kern
Sent: Friday, March 17, 2006 3:24 PM
To: activedirectory
Subject: [ActiveDir] AdminSDHolder
This may sound like a stupid question, but here goes-When MS says that Print Operators, Account Operators,or Backup Operators are protected by the PDCE checking the ACL on the AdminSDHolder object, I never see those groups in the ACE.Where are they listed?How are they protected?What ACL is the PDCE checking to determine what perms should be present for those groups?Thanks and sorry again if this seems really stupid or basic.
