Five common questions about AdminSdHolder and SDProp

re: Five common questions about AdminSdHolder and SDProp

AmyPadgett — Mon, 11 May 2009 23:40:38 GMT

I've wrestled with this issue for a number of years. I finally wrote up a tongue-in-cheek blog about it as a way to avoid a murder charge.

http://enterpriseadminanon.blogspot.com/

Enjoy--Amy

re: Five common questions about AdminSdHolder and SDProp

AmyPadgett — Mon, 11 May 2009 23:40:12 GMT

I've wrestled with this issue for a number of years. I finally wrote up a tongue-in-cheek blog about it as a way to avoid a murder charge.

http://enterpriseadminanon.blogspot.com/

Enjoy--Amy

re: Five common questions about AdminSdHolder and SDProp

NedPyle [MSFT] — Fri, 08 May 2009 16:59:19 GMT

Yep, I cannot get it to flip with just AdminCount=1 anymore. Nice catch Tony, I've updated that piece as well.

re: Five common questions about AdminSdHolder and SDProp

NedPyle [MSFT] — Fri, 08 May 2009 16:17:13 GMT

You are right about SDPROP - I was trying to oversimplify here without going into the actual undocumented worker that makes up AdminSDholder, but ended up making it sound like they were one in the same - in reality they are related, but only in passing. I've tweaked the article a bit to make more sense, let me know what you think.

I'm trying out the AdminCount part right now in a repro. From looking at source code (rather than trusting an internal doc), I am beginning to suspect that you are right - once upon a time this might have been the case, but no longer since at least 2003. I'll change that part too if needed.

Thanks Tony!

re: Five common questions about AdminSdHolder and SDProp

Mike Kline — Fri, 08 May 2009 16:06:50 GMT

Another good article Ned, I always wondered why the decision was made not to "decrement" AdminCount. I see people on certain newsgroups confused because the accounts are no longer in a protected group.

Another good blog entry on this subject is from Ulf Simon

http://msmvps.com/blogs/ulfbsimonweidner/archive/2005/05/29/49659.aspx

Thanks

Mike

re: Five common questions about AdminSdHolder and SDProp

murrato1 — Fri, 08 May 2009 06:33:35 GMT

Hi Ned

Thanks for posting the article. This an area that can, as you indicate, cause much confusion. Just a couple of comments.

1. My understanding is that task that does the AdminSDHolder protection evaluation and sets the security descriptor on protected objects is not in fact SDPROP. As far as I know there is no clear name for the task - I just call it "the AdminSDHolder task." Whenever a change is made to an object's security descriptor, SDPROP is invoked simply to propagate the changes to child objects. In other words when objects are first protected by the AdminSDHolder task SDPROP is invoked, but doesn't really change anything (unless of course the object has child objects).

This based on my understanding from an email conversation I had with someone knowledgeable a while back, so I could be wrong.

2. You say..."since it's assumed that regardless of group membership, AdminCount being 1 should trigger protection." This does not appear to be the case. If I set the adminCount value to 1 on an unprotected object it does not become protected on the next (hourly) cycle.

Tony

Ask the Directory Services Team : Five common questions about … | Webmaster Tools

Fri, 08 May 2009 02:05:14 GMT

PingBack from http://www.netdeluxo.com/blog/blogs/ask-the-directory-services-team-five-common-questions-about/