| 1 | # Add default primary groups (domain users, domain guests) - needed for
|
|---|
| 2 | # the users to find valid primary groups (samldb module)
|
|---|
| 3 |
|
|---|
| 4 | dn: CN=Domain Users,CN=Users,${DOMAINDN}
|
|---|
| 5 | objectClass: top
|
|---|
| 6 | objectClass: group
|
|---|
| 7 | description: All domain users
|
|---|
| 8 | objectSid: ${DOMAINSID}-513
|
|---|
| 9 | sAMAccountName: Domain Users
|
|---|
| 10 | isCriticalSystemObject: TRUE
|
|---|
| 11 |
|
|---|
| 12 | dn: CN=Domain Guests,CN=Users,${DOMAINDN}
|
|---|
| 13 | objectClass: top
|
|---|
| 14 | objectClass: group
|
|---|
| 15 | description: All domain guests
|
|---|
| 16 | objectSid: ${DOMAINSID}-514
|
|---|
| 17 | sAMAccountName: Domain Guests
|
|---|
| 18 | isCriticalSystemObject: TRUE
|
|---|
| 19 |
|
|---|
| 20 | # Add users
|
|---|
| 21 |
|
|---|
| 22 | dn: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 23 | objectClass: user
|
|---|
| 24 | description: Built-in account for administering the computer/domain
|
|---|
| 25 | userAccountControl: 66048
|
|---|
| 26 | objectSid: ${DOMAINSID}-500
|
|---|
| 27 | adminCount: 1
|
|---|
| 28 | accountExpires: 9223372036854775807
|
|---|
| 29 | sAMAccountName: Administrator
|
|---|
| 30 | userPassword:: ${ADMINPASS_B64}
|
|---|
| 31 | isCriticalSystemObject: TRUE
|
|---|
| 32 |
|
|---|
| 33 | dn: CN=Guest,CN=Users,${DOMAINDN}
|
|---|
| 34 | objectClass: user
|
|---|
| 35 | description: Built-in account for guest access to the computer/domain
|
|---|
| 36 | userAccountControl: 66082
|
|---|
| 37 | primaryGroupID: 514
|
|---|
| 38 | objectSid: ${DOMAINSID}-501
|
|---|
| 39 | sAMAccountName: Guest
|
|---|
| 40 | isCriticalSystemObject: TRUE
|
|---|
| 41 |
|
|---|
| 42 | dn: CN=krbtgt,CN=Users,${DOMAINDN}
|
|---|
| 43 | objectClass: top
|
|---|
| 44 | objectClass: person
|
|---|
| 45 | objectClass: organizationalPerson
|
|---|
| 46 | objectClass: user
|
|---|
| 47 | description: Key Distribution Center Service Account
|
|---|
| 48 | showInAdvancedViewOnly: TRUE
|
|---|
| 49 | userAccountControl: 514
|
|---|
| 50 | objectSid: ${DOMAINSID}-502
|
|---|
| 51 | adminCount: 1
|
|---|
| 52 | accountExpires: 9223372036854775807
|
|---|
| 53 | sAMAccountName: krbtgt
|
|---|
| 54 | servicePrincipalName: kadmin/changepw
|
|---|
| 55 | userPassword:: ${KRBTGTPASS_B64}
|
|---|
| 56 | isCriticalSystemObject: TRUE
|
|---|
| 57 |
|
|---|
| 58 | # Add other groups
|
|---|
| 59 |
|
|---|
| 60 | dn: CN=Enterprise Admins,CN=Users,${DOMAINDN}
|
|---|
| 61 | objectClass: top
|
|---|
| 62 | objectClass: group
|
|---|
| 63 | description: Designated administrators of the enterprise
|
|---|
| 64 | member: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 65 | objectSid: ${DOMAINSID}-519
|
|---|
| 66 | adminCount: 1
|
|---|
| 67 | sAMAccountName: Enterprise Admins
|
|---|
| 68 | isCriticalSystemObject: TRUE
|
|---|
| 69 |
|
|---|
| 70 | dn: CN=Domain Computers,CN=Users,${DOMAINDN}
|
|---|
| 71 | objectClass: top
|
|---|
| 72 | objectClass: group
|
|---|
| 73 | description: All workstations and servers joined to the domain
|
|---|
| 74 | objectSid: ${DOMAINSID}-515
|
|---|
| 75 | sAMAccountName: Domain Computers
|
|---|
| 76 | isCriticalSystemObject: TRUE
|
|---|
| 77 |
|
|---|
| 78 | dn: CN=Domain Controllers,CN=Users,${DOMAINDN}
|
|---|
| 79 | objectClass: top
|
|---|
| 80 | objectClass: group
|
|---|
| 81 | description: All domain controllers in the domain
|
|---|
| 82 | objectSid: ${DOMAINSID}-516
|
|---|
| 83 | adminCount: 1
|
|---|
| 84 | sAMAccountName: Domain Controllers
|
|---|
| 85 | isCriticalSystemObject: TRUE
|
|---|
| 86 |
|
|---|
| 87 | dn: CN=Schema Admins,CN=Users,${DOMAINDN}
|
|---|
| 88 | objectClass: top
|
|---|
| 89 | objectClass: group
|
|---|
| 90 | description: Designated administrators of the schema
|
|---|
| 91 | member: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 92 | objectSid: ${DOMAINSID}-518
|
|---|
| 93 | adminCount: 1
|
|---|
| 94 | sAMAccountName: Schema Admins
|
|---|
| 95 | isCriticalSystemObject: TRUE
|
|---|
| 96 |
|
|---|
| 97 | dn: CN=Cert Publishers,CN=Users,${DOMAINDN}
|
|---|
| 98 | objectClass: top
|
|---|
| 99 | objectClass: group
|
|---|
| 100 | description: Members of this group are permitted to publish certificates to the Active Directory
|
|---|
| 101 | groupType: -2147483644
|
|---|
| 102 | objectSid: ${DOMAINSID}-517
|
|---|
| 103 | sAMAccountName: Cert Publishers
|
|---|
| 104 | isCriticalSystemObject: TRUE
|
|---|
| 105 |
|
|---|
| 106 | dn: CN=Domain Admins,CN=Users,${DOMAINDN}
|
|---|
| 107 | objectClass: top
|
|---|
| 108 | objectClass: group
|
|---|
| 109 | description: Designated administrators of the domain
|
|---|
| 110 | member: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 111 | objectSid: ${DOMAINSID}-512
|
|---|
| 112 | adminCount: 1
|
|---|
| 113 | sAMAccountName: Domain Admins
|
|---|
| 114 | isCriticalSystemObject: TRUE
|
|---|
| 115 |
|
|---|
| 116 | dn: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
|
|---|
| 117 | objectClass: top
|
|---|
| 118 | objectClass: group
|
|---|
| 119 | description: Members in this group can modify group policy for the domain
|
|---|
| 120 | member: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 121 | objectSid: ${DOMAINSID}-520
|
|---|
| 122 | sAMAccountName: Group Policy Creator Owners
|
|---|
| 123 | isCriticalSystemObject: TRUE
|
|---|
| 124 |
|
|---|
| 125 | dn: CN=RAS and IAS Servers,CN=Users,${DOMAINDN}
|
|---|
| 126 | objectClass: top
|
|---|
| 127 | objectClass: group
|
|---|
| 128 | description: Servers in this group can access remote access properties of users
|
|---|
| 129 | objectSid: ${DOMAINSID}-553
|
|---|
| 130 | sAMAccountName: RAS and IAS Servers
|
|---|
| 131 | groupType: -2147483644
|
|---|
| 132 | isCriticalSystemObject: TRUE
|
|---|
| 133 |
|
|---|
| 134 | dn: CN=Read-Only Domain Controllers,CN=Users,${DOMAINDN}
|
|---|
| 135 | objectClass: top
|
|---|
| 136 | objectClass: group
|
|---|
| 137 | description: read-only domain controllers
|
|---|
| 138 | objectSid: ${DOMAINSID}-521
|
|---|
| 139 | sAMAccountName: Read-Only Domain Controllers
|
|---|
| 140 | groupType: -2147483644
|
|---|
| 141 | isCriticalSystemObject: TRUE
|
|---|
| 142 |
|
|---|
| 143 | dn: CN=Enterprise Read-Only Domain Controllers,CN=Users,${DOMAINDN}
|
|---|
| 144 | objectClass: top
|
|---|
| 145 | objectClass: group
|
|---|
| 146 | description: enterprise read-only domain controllers
|
|---|
| 147 | objectSid: ${DOMAINSID}-498
|
|---|
| 148 | sAMAccountName: Enterprise Read-Only Domain Controllers
|
|---|
| 149 | groupType: -2147483644
|
|---|
| 150 | isCriticalSystemObject: TRUE
|
|---|
| 151 |
|
|---|
| 152 | dn: CN=Certificate Service DCOM Access,CN=Users,${DOMAINDN}
|
|---|
| 153 | objectClass: top
|
|---|
| 154 | objectClass: group
|
|---|
| 155 | description: Certificate Service DCOM Access
|
|---|
| 156 | objectSid: ${DOMAINSID}-574
|
|---|
| 157 | sAMAccountName: Certificate Service DCOM Access
|
|---|
| 158 | groupType: -2147483644
|
|---|
| 159 | isCriticalSystemObject: TRUE
|
|---|
| 160 |
|
|---|
| 161 | dn: CN=Cryptographic Operators,CN=Users,${DOMAINDN}
|
|---|
| 162 | objectClass: top
|
|---|
| 163 | objectClass: group
|
|---|
| 164 | description: Cryptographic Operators
|
|---|
| 165 | objectSid: ${DOMAINSID}-569
|
|---|
| 166 | sAMAccountName: Cryptographic Operators
|
|---|
| 167 | groupType: -2147483644
|
|---|
| 168 | isCriticalSystemObject: TRUE
|
|---|
| 169 |
|
|---|
| 170 | dn: CN=Event Log Readers,CN=Users,${DOMAINDN}
|
|---|
| 171 | objectClass: top
|
|---|
| 172 | objectClass: group
|
|---|
| 173 | description: Event Log Readers
|
|---|
| 174 | objectSid: ${DOMAINSID}-573
|
|---|
| 175 | sAMAccountName: Event Log Readers
|
|---|
| 176 | groupType: -2147483644
|
|---|
| 177 | isCriticalSystemObject: TRUE
|
|---|
| 178 |
|
|---|
| 179 | # Add foreign security principals
|
|---|
| 180 |
|
|---|
| 181 | dn: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 182 | objectClass: top
|
|---|
| 183 | objectClass: foreignSecurityPrincipal
|
|---|
| 184 | objectSid: S-1-5-4
|
|---|
| 185 |
|
|---|
| 186 | dn: CN=S-1-5-9,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 187 | objectClass: top
|
|---|
| 188 | objectClass: foreignSecurityPrincipal
|
|---|
| 189 | objectSid: S-1-5-9
|
|---|
| 190 |
|
|---|
| 191 | dn: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 192 | objectClass: top
|
|---|
| 193 | objectClass: foreignSecurityPrincipal
|
|---|
| 194 | objectSid: S-1-5-11
|
|---|
| 195 |
|
|---|
| 196 | dn: CN=S-1-5-20,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 197 | objectClass: top
|
|---|
| 198 | objectClass: foreignSecurityPrincipal
|
|---|
| 199 | objectSid: S-1-5-20
|
|---|
| 200 |
|
|---|
| 201 | # Add builtin objects
|
|---|
| 202 |
|
|---|
| 203 | dn: CN=Administrators,CN=Builtin,${DOMAINDN}
|
|---|
| 204 | objectClass: top
|
|---|
| 205 | objectClass: group
|
|---|
| 206 | description: Administrators have complete and unrestricted access to the computer/domain
|
|---|
| 207 | member: CN=Domain Admins,CN=Users,${DOMAINDN}
|
|---|
| 208 | member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
|
|---|
| 209 | member: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 210 | objectSid: S-1-5-32-544
|
|---|
| 211 | adminCount: 1
|
|---|
| 212 | sAMAccountName: Administrators
|
|---|
| 213 | systemFlags: -1946157056
|
|---|
| 214 | groupType: -2147483643
|
|---|
| 215 | privilege: SeSecurityPrivilege
|
|---|
| 216 | privilege: SeBackupPrivilege
|
|---|
| 217 | privilege: SeRestorePrivilege
|
|---|
| 218 | privilege: SeSystemtimePrivilege
|
|---|
| 219 | privilege: SeShutdownPrivilege
|
|---|
| 220 | privilege: SeRemoteShutdownPrivilege
|
|---|
| 221 | privilege: SeTakeOwnershipPrivilege
|
|---|
| 222 | privilege: SeDebugPrivilege
|
|---|
| 223 | privilege: SeSystemEnvironmentPrivilege
|
|---|
| 224 | privilege: SeSystemProfilePrivilege
|
|---|
| 225 | privilege: SeProfileSingleProcessPrivilege
|
|---|
| 226 | privilege: SeIncreaseBasePriorityPrivilege
|
|---|
| 227 | privilege: SeLoadDriverPrivilege
|
|---|
| 228 | privilege: SeCreatePagefilePrivilege
|
|---|
| 229 | privilege: SeIncreaseQuotaPrivilege
|
|---|
| 230 | privilege: SeChangeNotifyPrivilege
|
|---|
| 231 | privilege: SeUndockPrivilege
|
|---|
| 232 | privilege: SeManageVolumePrivilege
|
|---|
| 233 | privilege: SeImpersonatePrivilege
|
|---|
| 234 | privilege: SeCreateGlobalPrivilege
|
|---|
| 235 | privilege: SeEnableDelegationPrivilege
|
|---|
| 236 | privilege: SeInteractiveLogonRight
|
|---|
| 237 | privilege: SeNetworkLogonRight
|
|---|
| 238 | privilege: SeRemoteInteractiveLogonRight
|
|---|
| 239 | isCriticalSystemObject: TRUE
|
|---|
| 240 |
|
|---|
| 241 | dn: CN=Users,CN=Builtin,${DOMAINDN}
|
|---|
| 242 | objectClass: top
|
|---|
| 243 | objectClass: group
|
|---|
| 244 | description: Users are prevented from making accidental or intentional system-wide changes. Thus, Users can run certified applications, but not most legacy applications
|
|---|
| 245 | member: CN=Domain Users,CN=Users,${DOMAINDN}
|
|---|
| 246 | member: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 247 | member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 248 | objectSid: S-1-5-32-545
|
|---|
| 249 | sAMAccountName: Users
|
|---|
| 250 | systemFlags: -1946157056
|
|---|
| 251 | groupType: -2147483643
|
|---|
| 252 | isCriticalSystemObject: TRUE
|
|---|
| 253 |
|
|---|
| 254 | dn: CN=Guests,CN=Builtin,${DOMAINDN}
|
|---|
| 255 | objectClass: top
|
|---|
| 256 | objectClass: group
|
|---|
| 257 | description: Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted
|
|---|
| 258 | member: CN=Domain Guests,CN=Users,${DOMAINDN}
|
|---|
| 259 | member: CN=Guest,CN=Users,${DOMAINDN}
|
|---|
| 260 | objectSid: S-1-5-32-546
|
|---|
| 261 | sAMAccountName: Guests
|
|---|
| 262 | systemFlags: -1946157056
|
|---|
| 263 | groupType: -2147483643
|
|---|
| 264 | isCriticalSystemObject: TRUE
|
|---|
| 265 |
|
|---|
| 266 | dn: CN=Print Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 267 | objectClass: top
|
|---|
| 268 | objectClass: group
|
|---|
| 269 | description: Members can administer domain printers
|
|---|
| 270 | objectSid: S-1-5-32-550
|
|---|
| 271 | adminCount: 1
|
|---|
| 272 | sAMAccountName: Print Operators
|
|---|
| 273 | systemFlags: -1946157056
|
|---|
| 274 | groupType: -2147483643
|
|---|
| 275 | privilege: SeLoadDriverPrivilege
|
|---|
| 276 | privilege: SeShutdownPrivilege
|
|---|
| 277 | privilege: SeInteractiveLogonRight
|
|---|
| 278 | isCriticalSystemObject: TRUE
|
|---|
| 279 |
|
|---|
| 280 | dn: CN=Backup Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 281 | objectClass: top
|
|---|
| 282 | objectClass: group
|
|---|
| 283 | description: Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
|
|---|
| 284 | objectSid: S-1-5-32-551
|
|---|
| 285 | adminCount: 1
|
|---|
| 286 | sAMAccountName: Backup Operators
|
|---|
| 287 | systemFlags: -1946157056
|
|---|
| 288 | groupType: -2147483643
|
|---|
| 289 | privilege: SeBackupPrivilege
|
|---|
| 290 | privilege: SeRestorePrivilege
|
|---|
| 291 | privilege: SeShutdownPrivilege
|
|---|
| 292 | privilege: SeInteractiveLogonRight
|
|---|
| 293 | isCriticalSystemObject: TRUE
|
|---|
| 294 |
|
|---|
| 295 | dn: CN=Replicator,CN=Builtin,${DOMAINDN}
|
|---|
| 296 | objectClass: top
|
|---|
| 297 | objectClass: group
|
|---|
| 298 | description: Supports file replication in a domain
|
|---|
| 299 | objectSid: S-1-5-32-552
|
|---|
| 300 | adminCount: 1
|
|---|
| 301 | sAMAccountName: Replicator
|
|---|
| 302 | systemFlags: -1946157056
|
|---|
| 303 | groupType: -2147483643
|
|---|
| 304 | isCriticalSystemObject: TRUE
|
|---|
| 305 |
|
|---|
| 306 | dn: CN=Remote Desktop Users,CN=Builtin,${DOMAINDN}
|
|---|
| 307 | objectClass: top
|
|---|
| 308 | objectClass: group
|
|---|
| 309 | description: Members in this group are granted the right to logon remotely
|
|---|
| 310 | objectSid: S-1-5-32-555
|
|---|
| 311 | sAMAccountName: Remote Desktop Users
|
|---|
| 312 | systemFlags: -1946157056
|
|---|
| 313 | groupType: -2147483643
|
|---|
| 314 | isCriticalSystemObject: TRUE
|
|---|
| 315 |
|
|---|
| 316 | dn: CN=Network Configuration Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 317 | objectClass: top
|
|---|
| 318 | objectClass: group
|
|---|
| 319 | description: Members in this group can have some administrative privileges to manage configuration of networking features
|
|---|
| 320 | objectSid: S-1-5-32-556
|
|---|
| 321 | sAMAccountName: Network Configuration Operators
|
|---|
| 322 | systemFlags: -1946157056
|
|---|
| 323 | groupType: -2147483643
|
|---|
| 324 | isCriticalSystemObject: TRUE
|
|---|
| 325 |
|
|---|
| 326 | dn: CN=Performance Monitor Users,CN=Builtin,${DOMAINDN}
|
|---|
| 327 | objectClass: top
|
|---|
| 328 | objectClass: group
|
|---|
| 329 | description: Members of this group have remote access to monitor this computer
|
|---|
| 330 | objectSid: S-1-5-32-558
|
|---|
| 331 | sAMAccountName: Performance Monitor Users
|
|---|
| 332 | systemFlags: -1946157056
|
|---|
| 333 | groupType: -2147483643
|
|---|
| 334 | isCriticalSystemObject: TRUE
|
|---|
| 335 |
|
|---|
| 336 | dn: CN=Performance Log Users,CN=Builtin,${DOMAINDN}
|
|---|
| 337 | objectClass: top
|
|---|
| 338 | objectClass: group
|
|---|
| 339 | description: Members of this group have remote access to schedule logging of performance counters on this computer
|
|---|
| 340 | member: CN=S-1-5-20,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 341 | objectSid: S-1-5-32-559
|
|---|
| 342 | sAMAccountName: Performance Log Users
|
|---|
| 343 | systemFlags: -1946157056
|
|---|
| 344 | groupType: -2147483643
|
|---|
| 345 | isCriticalSystemObject: TRUE
|
|---|
| 346 |
|
|---|
| 347 | dn: CN=Server Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 348 | objectClass: top
|
|---|
| 349 | objectClass: group
|
|---|
| 350 | description: Members can administer domain servers
|
|---|
| 351 | objectSid: S-1-5-32-549
|
|---|
| 352 | adminCount: 1
|
|---|
| 353 | sAMAccountName: Server Operators
|
|---|
| 354 | systemFlags: -1946157056
|
|---|
| 355 | groupType: -2147483643
|
|---|
| 356 | privilege: SeBackupPrivilege
|
|---|
| 357 | privilege: SeSystemtimePrivilege
|
|---|
| 358 | privilege: SeRemoteShutdownPrivilege
|
|---|
| 359 | privilege: SeRestorePrivilege
|
|---|
| 360 | privilege: SeShutdownPrivilege
|
|---|
| 361 | privilege: SeInteractiveLogonRight
|
|---|
| 362 | isCriticalSystemObject: TRUE
|
|---|
| 363 |
|
|---|
| 364 | dn: CN=Account Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 365 | objectClass: top
|
|---|
| 366 | objectClass: group
|
|---|
| 367 | description: Members can administer domain user and group accounts
|
|---|
| 368 | objectSid: S-1-5-32-548
|
|---|
| 369 | adminCount: 1
|
|---|
| 370 | sAMAccountName: Account Operators
|
|---|
| 371 | systemFlags: -1946157056
|
|---|
| 372 | groupType: -2147483643
|
|---|
| 373 | privilege: SeInteractiveLogonRight
|
|---|
| 374 | isCriticalSystemObject: TRUE
|
|---|
| 375 |
|
|---|
| 376 | dn: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,${DOMAINDN}
|
|---|
| 377 | objectClass: top
|
|---|
| 378 | objectClass: group
|
|---|
| 379 | description: A backward compatibility group which allows read access on all users and groups in the domain
|
|---|
| 380 | member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 381 | objectSid: S-1-5-32-554
|
|---|
| 382 | sAMAccountName: Pre-Windows 2000 Compatible Access
|
|---|
| 383 | systemFlags: -1946157056
|
|---|
| 384 | groupType: -2147483643
|
|---|
| 385 | privilege: SeRemoteInteractiveLogonRight
|
|---|
| 386 | privilege: SeChangeNotifyPrivilege
|
|---|
| 387 | isCriticalSystemObject: TRUE
|
|---|
| 388 |
|
|---|
| 389 | dn: CN=Incoming Forest Trust Builders,CN=Builtin,${DOMAINDN}
|
|---|
| 390 | objectClass: top
|
|---|
| 391 | objectClass: group
|
|---|
| 392 | description: Members of this group can create incoming, one-way trusts to this forest
|
|---|
| 393 | objectSid: S-1-5-32-557
|
|---|
| 394 | sAMAccountName: Incoming Forest Trust Builders
|
|---|
| 395 | systemFlags: -1946157056
|
|---|
| 396 | groupType: -2147483643
|
|---|
| 397 | isCriticalSystemObject: TRUE
|
|---|
| 398 |
|
|---|
| 399 | dn: CN=Windows Authorization Access Group,CN=Builtin,${DOMAINDN}
|
|---|
| 400 | objectClass: top
|
|---|
| 401 | objectClass: group
|
|---|
| 402 | description: Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects
|
|---|
| 403 | member: CN=S-1-5-9,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 404 | objectSid: S-1-5-32-560
|
|---|
| 405 | sAMAccountName: Windows Authorization Access Group
|
|---|
| 406 | systemFlags: -1946157056
|
|---|
| 407 | groupType: -2147483643
|
|---|
| 408 | isCriticalSystemObject: TRUE
|
|---|
| 409 |
|
|---|
| 410 | dn: CN=Terminal Server License Servers,CN=Builtin,${DOMAINDN}
|
|---|
| 411 | objectClass: top
|
|---|
| 412 | objectClass: group
|
|---|
| 413 | description: Terminal Server License Servers
|
|---|
| 414 | objectSid: S-1-5-32-561
|
|---|
| 415 | sAMAccountName: Terminal Server License Servers
|
|---|
| 416 | systemFlags: -1946157056
|
|---|
| 417 | groupType: -2147483643
|
|---|
| 418 | isCriticalSystemObject: TRUE
|
|---|
| 419 |
|
|---|
| 420 | dn: CN=Distributed COM Users,CN=Builtin,${DOMAINDN}
|
|---|
| 421 | objectClass: top
|
|---|
| 422 | objectClass: group
|
|---|
| 423 | description: Members are allowed to launch, activate and use Distributed COM objects on this machine.
|
|---|
| 424 | objectSid: S-1-5-32-562
|
|---|
| 425 | sAMAccountName: Distributed COM Users
|
|---|
| 426 | systemFlags: -1946157056
|
|---|
| 427 | groupType: -2147483643
|
|---|
| 428 | isCriticalSystemObject: TRUE
|
|---|
| 429 |
|
|---|
| 430 | # Add well known security principals
|
|---|
| 431 |
|
|---|
| 432 | dn: CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 433 | objectClass: top
|
|---|
| 434 | objectClass: container
|
|---|
| 435 | systemFlags: -2147483648
|
|---|
| 436 |
|
|---|
| 437 | dn: CN=Anonymous Logon,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 438 | objectClass: top
|
|---|
| 439 | objectClass: foreignSecurityPrincipal
|
|---|
| 440 | objectSid: S-1-5-7
|
|---|
| 441 |
|
|---|
| 442 | dn: CN=Authenticated Users,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 443 | objectClass: top
|
|---|
| 444 | objectClass: foreignSecurityPrincipal
|
|---|
| 445 | objectSid: S-1-5-11
|
|---|
| 446 |
|
|---|
| 447 | dn: CN=Batch,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 448 | objectClass: top
|
|---|
| 449 | objectClass: foreignSecurityPrincipal
|
|---|
| 450 | objectSid: S-1-5-3
|
|---|
| 451 |
|
|---|
| 452 | dn: CN=Creator Group,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 453 | objectClass: top
|
|---|
| 454 | objectClass: foreignSecurityPrincipal
|
|---|
| 455 | objectSid: S-1-3-1
|
|---|
| 456 |
|
|---|
| 457 | dn: CN=Creator Owner,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 458 | objectClass: top
|
|---|
| 459 | objectClass: foreignSecurityPrincipal
|
|---|
| 460 | objectSid: S-1-3-0
|
|---|
| 461 |
|
|---|
| 462 | dn: CN=Dialup,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 463 | objectClass: top
|
|---|
| 464 | objectClass: foreignSecurityPrincipal
|
|---|
| 465 | objectSid: S-1-5-1
|
|---|
| 466 |
|
|---|
| 467 | dn: CN=Digest Authentication,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 468 | objectClass: top
|
|---|
| 469 | objectClass: foreignSecurityPrincipal
|
|---|
| 470 | objectSid: S-1-5-64-21
|
|---|
| 471 |
|
|---|
| 472 | dn: CN=Enterprise Domain Controllers,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 473 | objectClass: top
|
|---|
| 474 | objectClass: foreignSecurityPrincipal
|
|---|
| 475 | objectSid: S-1-5-9
|
|---|
| 476 |
|
|---|
| 477 | dn: CN=Everyone,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 478 | objectClass: top
|
|---|
| 479 | objectClass: foreignSecurityPrincipal
|
|---|
| 480 | objectSid: S-1-1-0
|
|---|
| 481 |
|
|---|
| 482 | dn: CN=Interactive,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 483 | objectClass: top
|
|---|
| 484 | objectClass: foreignSecurityPrincipal
|
|---|
| 485 | objectSid: S-1-5-4
|
|---|
| 486 |
|
|---|
| 487 | dn: CN=Local Service,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 488 | objectClass: top
|
|---|
| 489 | objectClass: foreignSecurityPrincipal
|
|---|
| 490 | objectSid: S-1-5-19
|
|---|
| 491 |
|
|---|
| 492 | dn: CN=Network,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 493 | objectClass: top
|
|---|
| 494 | objectClass: foreignSecurityPrincipal
|
|---|
| 495 | objectSid: S-1-5-2
|
|---|
| 496 |
|
|---|
| 497 | dn: CN=Network Service,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 498 | objectClass: top
|
|---|
| 499 | objectClass: foreignSecurityPrincipal
|
|---|
| 500 | objectSid: S-1-5-20
|
|---|
| 501 |
|
|---|
| 502 | dn: CN=NTLM Authentication,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 503 | objectClass: top
|
|---|
| 504 | objectClass: foreignSecurityPrincipal
|
|---|
| 505 | objectSid: S-1-5-64-10
|
|---|
| 506 |
|
|---|
| 507 | dn: CN=Other Organization,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 508 | objectClass: top
|
|---|
| 509 | objectClass: foreignSecurityPrincipal
|
|---|
| 510 | objectSid: S-1-5-1000
|
|---|
| 511 |
|
|---|
| 512 | dn: CN=Proxy,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 513 | objectClass: top
|
|---|
| 514 | objectClass: foreignSecurityPrincipal
|
|---|
| 515 | objectSid: S-1-5-8
|
|---|
| 516 |
|
|---|
| 517 | dn: CN=Remote Interactive Logon,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 518 | objectClass: top
|
|---|
| 519 | objectClass: foreignSecurityPrincipal
|
|---|
| 520 | objectSid: S-1-5-14
|
|---|
| 521 |
|
|---|
| 522 | dn: CN=Restricted,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 523 | objectClass: top
|
|---|
| 524 | objectClass: foreignSecurityPrincipal
|
|---|
| 525 | objectSid: S-1-5-12
|
|---|
| 526 |
|
|---|
| 527 | dn: CN=SChannel Authentication,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 528 | objectClass: top
|
|---|
| 529 | objectClass: foreignSecurityPrincipal
|
|---|
| 530 | objectSid: S-1-5-64-14
|
|---|
| 531 |
|
|---|
| 532 | dn: CN=Self,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 533 | objectClass: top
|
|---|
| 534 | objectClass: foreignSecurityPrincipal
|
|---|
| 535 | objectSid: S-1-5-10
|
|---|
| 536 |
|
|---|
| 537 | dn: CN=Service,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 538 | objectClass: top
|
|---|
| 539 | objectClass: foreignSecurityPrincipal
|
|---|
| 540 | objectSid: S-1-5-6
|
|---|
| 541 |
|
|---|
| 542 | dn: CN=Terminal Server User,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 543 | objectClass: top
|
|---|
| 544 | objectClass: foreignSecurityPrincipal
|
|---|
| 545 | objectSid: S-1-5-13
|
|---|
| 546 |
|
|---|
| 547 | dn: CN=This Organization,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 548 | objectClass: top
|
|---|
| 549 | objectClass: foreignSecurityPrincipal
|
|---|
| 550 | objectSid: S-1-5-15
|
|---|
| 551 |
|
|---|
| 552 | dn: CN=Well-Known-Security-Id-System,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 553 | objectClass: top
|
|---|
| 554 | objectClass: foreignSecurityPrincipal
|
|---|
| 555 | objectSid: S-1-5-18
|
|---|
