You use the AD security model to control who can make changes to certain objects. For example, the right Create Site Link Objects is relevant and applicable only to classes of objects that can contain site links.Įstablishing permissions for objects and their attributes is at the heart of AD delegation. Nineteen standard security rights are available within AD, and an object class can have any number of extended rights that are specific to that class. Security rights are the types of operations (e.g., read, write, delete) that you permit for a particular object. If an application adds a new object class or attribute and extends the AD schema, the schema extension might require additional security rights. Moreover, each object class can have a different set of security rights. This granularity allows a variety of possibilities when you assign permissions for your objects. AD lets you set permissions for entire objects and individual attributes of objects. For example, a user object has attributes such as First Name and Address, and an organizational unit (OU) object has attributes such as Description and Address. You also need to understand the AD ACL Editor and the Delegation of Control Wizard, and you need to be aware of the challenges and pitfalls you'll likely encounter as you devise your AD delegation strategy.

One of AD's most important features-its ability to support delegated administration of directory objects to groups of specified users-requires you to understand AD security and the complexities of managing permissions in AD. This shift will force many enterprises to deploy an AD infrastructure, thus creating the challenges of planning an AD implementation and managing it to meet the many needs of users and applications.

UPCOMING versions of many Microsoft products such as Exchange Server, Site Server, and SQL Server will rely on Active Directory (AD) instead of standalone directories. Complex tools don't always make your life easier

Active directory ou permissions report