Active Directory: Permission Delegation
Preface:
Our organization
is growing day by day, AD security becomes strict & its monitoring &
auditing has been done frequently. The AD infrastructure was built almost 13 years
back. Initially, it was built on Windows Server 2003, then from time to time, it is migrated
& presently all DCs are Windows Server 2019. (Domain & Forest
Functional Level is Windows Server 2008R2).
Goals:
Delegate IT Helpdesk ID (a member of G_ITHelpdesk)
for AD ID unlock, password reset & domain joining permission.
Observation & Actions:
1.
IT
Helpdesk Team uses a Domain Admin ID for their day to day jobs - AD ID unlocks, password reset, domain joining.
-
It is
clearly security breaching. Before revoking domain admin permission, we need to
create one Helpdesk ID (i.e. ITHelpdesk), I’ll prefer to delegate AD job
permission to a group (i.e. G_ITHelpdesk) & ITHelpdesk is the member of
this group.
2.
“Users”
and “Computers” OU for each department & nested in individual “Department”
OU.
-
Suppose
there is “Finance Dept” OU - Users & Computers are two OU nested into this
OU, similarly for “Marketing Dept” & other departments. This kind of AD structure is never recommended. It not only makes delegation tasks difficult, also makes it difficult to apply GPO.
So, I have created two master
OU, one for all computers (i.e. BLUE_Computers) & other for all users (i.e.
BLUE_Users). Under these OU, we have created different OU, such as Department,
Building or Floorwise. It is a good practice not to keep computers under the default “Computers” container, move it to different OU.
3.
Servers
are kept in the same master OU along with desktops/laptops. AD Groups are also sharing the same places along with users.
-
Servers
are moved to separate master OU (I.e BLUE_Servers). We can create separate OU
under this by their OS.
4.
Several
unused/disabled users & inactive/disabled computers are scattered across
the AD.
-
For
disabled, inactive object, separate master OU (i.e. BLUE_InactiveObjects).
So, before AD
permission delegation, in my scenario, AD restructure is required. Restructuring
existing AD required the utmost care. Before starting check all the GPOs deeply-
what is their settings, where it is applied, any exception or not, any “Block
Policy Inheritance”.Also sometimes application-specific OU is created, which
means the path of the OU is hardcoded into the application & only users
from this OU can be authenticated & permitted to access the application. I
have segregated all the GPOs according to their settings – either user-based or
computer base. (i.e. GPO_USR_Friendly Name or GPO_DTP_Friendly Name). Also recommend
you to start with either users or computers, not both at a time. My experience
says, start with computers because there are fewer GPOs for computers.
Process:
Delegation: Password Reset & ID Unlock
We’ll delegate all permission to the G_ITHelpdesk group. ITHelpdesk user is
a member of this group.
Select BLUE_Users > Delegate Control > Select User or Group (i.e.
G_ITHelpdesk) > Select “Create a custom task to delegate” > Select “Only
the following objects in the folder” & “User objects” > Select only “General” & “Property-specific” > In the permissions box select
following permission :
ü Reset password
ü Read lockout Time
ü Write lockout Time
ü Write pwdLast Set
Issue: Helpdesk Team may complain that
for few users, they are not able to unlock the AD ID or reset the password. Definitely, the delegated user can’t do these activities for domain users or protected users
(have higher privileged users). But issues may arise for a few normal users also.
It happens due to some changes in the properties of user ID – once these users may
had a higher privilege. You need to check the properties of these user ID > Security
tab > Advanced button > Check Inheritance button -inheritance
should be Enabled.
Delegation: Domain Join & Disjoin :
We’ll delegate this permission also
to G_ITHelpdesk group. ITHelpdesk user is a member of this group.
Select BLUE_Computers > Delegate
Control > Select
User or Group (i.e. G_ITHelpdesk) > Select “Create a
custom task to delegate” > Select “Only the following objects in the
folder” & “Computer
objects” > Select
only “General” & “Property-specific” > In the permissions box select following
permission :
ü Reset password
ü Read and write account restrictions
ü Validated write to DNS hostname
ü Validated write to service principal name
Finish windows display the details of the delegation with which permissions are delegated to the users/group. We’ll do the same delegation process for the “Computers” container. Because it is the default location for domain-joined computers. Though you can change it.
Pix:16: Delegation: Domain Join & Disjoin
This is not related to this article, as I find no comment box in the article I read in your blog article.
ReplyDeleteThis relates to the article in the link
https://suddhaman.blogspot.com/2019/04/ntp-configuration-for-time-sync.html
Please note that there is no comment box there.
The article is very useful in configuring and syncing time for domain and client computers
Here I find that ntp server ip usage instead of ntp server address
This has solved my sync problem
query one: is it risky to use ntp server for syncing purpose, as I read in so many articles that it is used as a source of ddos attack on router.
query two: How your client config command using ip, dynamically change the special poll interval.
I am not a network expert, but your command fixed my time sync.
query three: Even though the time is successfully syncing, windows internet time tab pops up error of timed out period .Is that a kind of bug
I have also mentioned this article to windows 11 forum tutorial q and a the link is given in post 31
https://www.elevenforum.com/t/sync-clock-time-with-internet-time-server-in-windows-11.1320/page-2#post-217977
Hi, Thanks for your thanks. Please kindly answer my queries
Delete