| 1 | # Add default primary groups (domain users, domain guests, domain computers &
|
|---|
| 2 | # domain controllers) - needed for the users to find valid primary groups
|
|---|
| 3 | # (samldb module)
|
|---|
| 4 |
|
|---|
| 5 | dn: CN=Domain Users,CN=Users,${DOMAINDN}
|
|---|
| 6 | objectClass: top
|
|---|
| 7 | objectClass: group
|
|---|
| 8 | description: All domain users
|
|---|
| 9 | objectSid: ${DOMAINSID}-513
|
|---|
| 10 | sAMAccountName: Domain Users
|
|---|
| 11 | isCriticalSystemObject: TRUE
|
|---|
| 12 |
|
|---|
| 13 | dn: CN=Domain Guests,CN=Users,${DOMAINDN}
|
|---|
| 14 | objectClass: top
|
|---|
| 15 | objectClass: group
|
|---|
| 16 | description: All domain guests
|
|---|
| 17 | objectSid: ${DOMAINSID}-514
|
|---|
| 18 | sAMAccountName: Domain Guests
|
|---|
| 19 | isCriticalSystemObject: TRUE
|
|---|
| 20 |
|
|---|
| 21 | dn: CN=Domain Computers,CN=Users,${DOMAINDN}
|
|---|
| 22 | objectClass: top
|
|---|
| 23 | objectClass: group
|
|---|
| 24 | description: All workstations and servers joined to the domain
|
|---|
| 25 | objectSid: ${DOMAINSID}-515
|
|---|
| 26 | sAMAccountName: Domain Computers
|
|---|
| 27 | isCriticalSystemObject: TRUE
|
|---|
| 28 |
|
|---|
| 29 | dn: CN=Domain Controllers,CN=Users,${DOMAINDN}
|
|---|
| 30 | objectClass: top
|
|---|
| 31 | objectClass: group
|
|---|
| 32 | description: All domain controllers in the domain
|
|---|
| 33 | objectSid: ${DOMAINSID}-516
|
|---|
| 34 | adminCount: 1
|
|---|
| 35 | sAMAccountName: Domain Controllers
|
|---|
| 36 | isCriticalSystemObject: TRUE
|
|---|
| 37 |
|
|---|
| 38 | # Add users
|
|---|
| 39 |
|
|---|
| 40 | dn: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 41 | objectClass: user
|
|---|
| 42 | description: Built-in account for administering the computer/domain
|
|---|
| 43 | userAccountControl: 512
|
|---|
| 44 | objectSid: ${DOMAINSID}-500
|
|---|
| 45 | adminCount: 1
|
|---|
| 46 | accountExpires: 9223372036854775807
|
|---|
| 47 | sAMAccountName: Administrator
|
|---|
| 48 | clearTextPassword:: ${ADMINPASS_B64}
|
|---|
| 49 | isCriticalSystemObject: TRUE
|
|---|
| 50 |
|
|---|
| 51 | dn: CN=Guest,CN=Users,${DOMAINDN}
|
|---|
| 52 | objectClass: user
|
|---|
| 53 | description: Built-in account for guest access to the computer/domain
|
|---|
| 54 | userAccountControl: 66082
|
|---|
| 55 | primaryGroupID: 514
|
|---|
| 56 | objectSid: ${DOMAINSID}-501
|
|---|
| 57 | sAMAccountName: Guest
|
|---|
| 58 | isCriticalSystemObject: TRUE
|
|---|
| 59 |
|
|---|
| 60 | dn: CN=krbtgt,CN=Users,${DOMAINDN}
|
|---|
| 61 | objectClass: top
|
|---|
| 62 | objectClass: person
|
|---|
| 63 | objectClass: organizationalPerson
|
|---|
| 64 | objectClass: user
|
|---|
| 65 | description: Key Distribution Center Service Account
|
|---|
| 66 | showInAdvancedViewOnly: TRUE
|
|---|
| 67 | userAccountControl: 514
|
|---|
| 68 | objectSid: ${DOMAINSID}-502
|
|---|
| 69 | adminCount: 1
|
|---|
| 70 | accountExpires: 9223372036854775807
|
|---|
| 71 | sAMAccountName: krbtgt
|
|---|
| 72 | servicePrincipalName: kadmin/changepw
|
|---|
| 73 | clearTextPassword:: ${KRBTGTPASS_B64}
|
|---|
| 74 | isCriticalSystemObject: TRUE
|
|---|
| 75 |
|
|---|
| 76 | # Add other groups
|
|---|
| 77 |
|
|---|
| 78 | dn: CN=Enterprise Read-only Domain Controllers,CN=Users,${DOMAINDN}
|
|---|
| 79 | objectClass: top
|
|---|
| 80 | objectClass: group
|
|---|
| 81 | description: Members of this group are Read-Only Domain Controllers in the enterprise
|
|---|
| 82 | objectSid: ${DOMAINSID}-498
|
|---|
| 83 | sAMAccountName: Enterprise Read-Only Domain Controllers
|
|---|
| 84 | groupType: -2147483640
|
|---|
| 85 | isCriticalSystemObject: TRUE
|
|---|
| 86 |
|
|---|
| 87 | dn: CN=Domain Admins,CN=Users,${DOMAINDN}
|
|---|
| 88 | objectClass: top
|
|---|
| 89 | objectClass: group
|
|---|
| 90 | description: Designated administrators of the domain
|
|---|
| 91 | member: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 92 | objectSid: ${DOMAINSID}-512
|
|---|
| 93 | adminCount: 1
|
|---|
| 94 | sAMAccountName: Domain Admins
|
|---|
| 95 | isCriticalSystemObject: TRUE
|
|---|
| 96 |
|
|---|
| 97 | dn: CN=Cert Publishers,CN=Users,${DOMAINDN}
|
|---|
| 98 | objectClass: top
|
|---|
| 99 | objectClass: group
|
|---|
| 100 | description: Members of this group are permitted to publish certificates to the directory
|
|---|
| 101 | objectSid: ${DOMAINSID}-517
|
|---|
| 102 | sAMAccountName: Cert Publishers
|
|---|
| 103 | groupType: -2147483644
|
|---|
| 104 | isCriticalSystemObject: TRUE
|
|---|
| 105 |
|
|---|
| 106 | dn: CN=Schema Admins,CN=Users,${DOMAINDN}
|
|---|
| 107 | objectClass: top
|
|---|
| 108 | objectClass: group
|
|---|
| 109 | description: Designated administrators of the schema
|
|---|
| 110 | member: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 111 | objectSid: ${DOMAINSID}-518
|
|---|
| 112 | adminCount: 1
|
|---|
| 113 | sAMAccountName: Schema Admins
|
|---|
| 114 | groupType: -2147483640
|
|---|
| 115 | isCriticalSystemObject: TRUE
|
|---|
| 116 |
|
|---|
| 117 | dn: CN=Enterprise Admins,CN=Users,${DOMAINDN}
|
|---|
| 118 | objectClass: top
|
|---|
| 119 | objectClass: group
|
|---|
| 120 | description: Designated administrators of the enterprise
|
|---|
| 121 | member: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 122 | objectSid: ${DOMAINSID}-519
|
|---|
| 123 | adminCount: 1
|
|---|
| 124 | sAMAccountName: Enterprise Admins
|
|---|
| 125 | groupType: -2147483640
|
|---|
| 126 | isCriticalSystemObject: TRUE
|
|---|
| 127 |
|
|---|
| 128 | dn: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
|
|---|
| 129 | objectClass: top
|
|---|
| 130 | objectClass: group
|
|---|
| 131 | description: Members in this group can modify group policy for the domain
|
|---|
| 132 | member: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 133 | objectSid: ${DOMAINSID}-520
|
|---|
| 134 | sAMAccountName: Group Policy Creator Owners
|
|---|
| 135 | isCriticalSystemObject: TRUE
|
|---|
| 136 |
|
|---|
| 137 | dn: CN=Read-only Domain Controllers,CN=Users,${DOMAINDN}
|
|---|
| 138 | objectClass: top
|
|---|
| 139 | objectClass: group
|
|---|
| 140 | description: Members of this group are Read-Only Domain Controllers in the domain
|
|---|
| 141 | objectSid: ${DOMAINSID}-521
|
|---|
| 142 | adminCount: 1
|
|---|
| 143 | sAMAccountName: Read-Only Domain Controllers
|
|---|
| 144 | isCriticalSystemObject: TRUE
|
|---|
| 145 |
|
|---|
| 146 | dn: CN=RAS and IAS Servers,CN=Users,${DOMAINDN}
|
|---|
| 147 | objectClass: top
|
|---|
| 148 | objectClass: group
|
|---|
| 149 | description: Servers in this group can access remote access properties of users
|
|---|
| 150 | objectSid: ${DOMAINSID}-553
|
|---|
| 151 | sAMAccountName: RAS and IAS Servers
|
|---|
| 152 | groupType: -2147483644
|
|---|
| 153 | isCriticalSystemObject: TRUE
|
|---|
| 154 |
|
|---|
| 155 | dn: CN=Allowed RODC Password Replication Group,CN=Users,${DOMAINDN}
|
|---|
| 156 | objectClass: top
|
|---|
| 157 | objectClass: group
|
|---|
| 158 | description: Members in this group can have their passwords replicated to all read-only domain controllers in the domain
|
|---|
| 159 | objectSid: ${DOMAINSID}-571
|
|---|
| 160 | sAMAccountName: Allowed RODC Password Replication Group
|
|---|
| 161 | groupType: -2147483644
|
|---|
| 162 | isCriticalSystemObject: TRUE
|
|---|
| 163 |
|
|---|
| 164 | dn: CN=Denied RODC Password Replication Group,CN=Users,${DOMAINDN}
|
|---|
| 165 | objectClass: top
|
|---|
| 166 | objectClass: group
|
|---|
| 167 | description: Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain
|
|---|
| 168 | member: CN=Read-only Domain Controllers,CN=Users,${DOMAINDN}
|
|---|
| 169 | member: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
|
|---|
| 170 | member: CN=Domain Admins,CN=Users,${DOMAINDN}
|
|---|
| 171 | member: CN=Cert Publishers,CN=Users,${DOMAINDN}
|
|---|
| 172 | member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
|
|---|
| 173 | member: CN=Schema Admins,CN=Users,${DOMAINDN}
|
|---|
| 174 | member: CN=Domain Controllers,CN=Users,${DOMAINDN}
|
|---|
| 175 | member: CN=krbtgt,CN=Users,${DOMAINDN}
|
|---|
| 176 | objectSid: ${DOMAINSID}-572
|
|---|
| 177 | sAMAccountName: Denied RODC Password Replication Group
|
|---|
| 178 | groupType: -2147483644
|
|---|
| 179 | isCriticalSystemObject: TRUE
|
|---|
| 180 |
|
|---|
| 181 | # NOTICE: Some other users and groups which rely on automatic SIDs are located
|
|---|
| 182 | # in "provision_self_join_modify.ldif"
|
|---|
| 183 |
|
|---|
| 184 | # Add foreign security principals
|
|---|
| 185 |
|
|---|
| 186 | dn: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 187 | objectClass: top
|
|---|
| 188 | objectClass: foreignSecurityPrincipal
|
|---|
| 189 | objectSid: S-1-5-4
|
|---|
| 190 |
|
|---|
| 191 | dn: CN=S-1-5-9,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 192 | objectClass: top
|
|---|
| 193 | objectClass: foreignSecurityPrincipal
|
|---|
| 194 | objectSid: S-1-5-9
|
|---|
| 195 |
|
|---|
| 196 | dn: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 197 | objectClass: top
|
|---|
| 198 | objectClass: foreignSecurityPrincipal
|
|---|
| 199 | objectSid: S-1-5-11
|
|---|
| 200 |
|
|---|
| 201 | dn: CN=S-1-5-17,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 202 | objectClass: top
|
|---|
| 203 | objectClass: foreignSecurityPrincipal
|
|---|
| 204 | objectSid: S-1-5-17
|
|---|
| 205 |
|
|---|
| 206 | # Add builtin objects
|
|---|
| 207 |
|
|---|
| 208 | dn: CN=Administrators,CN=Builtin,${DOMAINDN}
|
|---|
| 209 | objectClass: top
|
|---|
| 210 | objectClass: group
|
|---|
| 211 | description: Administrators have complete and unrestricted access to the computer/domain
|
|---|
| 212 | member: CN=Domain Admins,CN=Users,${DOMAINDN}
|
|---|
| 213 | member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
|
|---|
| 214 | member: CN=Administrator,CN=Users,${DOMAINDN}
|
|---|
| 215 | objectSid: S-1-5-32-544
|
|---|
| 216 | adminCount: 1
|
|---|
| 217 | sAMAccountName: Administrators
|
|---|
| 218 | systemFlags: -1946157056
|
|---|
| 219 | groupType: -2147483643
|
|---|
| 220 | isCriticalSystemObject: TRUE
|
|---|
| 221 |
|
|---|
| 222 | dn: CN=Users,CN=Builtin,${DOMAINDN}
|
|---|
| 223 | objectClass: top
|
|---|
| 224 | objectClass: group
|
|---|
| 225 | description: Users are prevented from making accidental or intentional system-wide changes and can run most applications
|
|---|
| 226 | member: CN=Domain Users,CN=Users,${DOMAINDN}
|
|---|
| 227 | member: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 228 | member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 229 | objectSid: S-1-5-32-545
|
|---|
| 230 | sAMAccountName: Users
|
|---|
| 231 | systemFlags: -1946157056
|
|---|
| 232 | groupType: -2147483643
|
|---|
| 233 | isCriticalSystemObject: TRUE
|
|---|
| 234 |
|
|---|
| 235 | dn: CN=Guests,CN=Builtin,${DOMAINDN}
|
|---|
| 236 | objectClass: top
|
|---|
| 237 | objectClass: group
|
|---|
| 238 | description: Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted
|
|---|
| 239 | member: CN=Domain Guests,CN=Users,${DOMAINDN}
|
|---|
| 240 | member: CN=Guest,CN=Users,${DOMAINDN}
|
|---|
| 241 | objectSid: S-1-5-32-546
|
|---|
| 242 | sAMAccountName: Guests
|
|---|
| 243 | systemFlags: -1946157056
|
|---|
| 244 | groupType: -2147483643
|
|---|
| 245 | isCriticalSystemObject: TRUE
|
|---|
| 246 |
|
|---|
| 247 | dn: CN=Account Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 248 | objectClass: top
|
|---|
| 249 | objectClass: group
|
|---|
| 250 | description: Members can administer domain user and group accounts
|
|---|
| 251 | objectSid: S-1-5-32-548
|
|---|
| 252 | adminCount: 1
|
|---|
| 253 | sAMAccountName: Account Operators
|
|---|
| 254 | systemFlags: -1946157056
|
|---|
| 255 | groupType: -2147483643
|
|---|
| 256 | isCriticalSystemObject: TRUE
|
|---|
| 257 |
|
|---|
| 258 | dn: CN=Server Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 259 | objectClass: top
|
|---|
| 260 | objectClass: group
|
|---|
| 261 | description: Members can administer domain servers
|
|---|
| 262 | objectSid: S-1-5-32-549
|
|---|
| 263 | adminCount: 1
|
|---|
| 264 | sAMAccountName: Server Operators
|
|---|
| 265 | systemFlags: -1946157056
|
|---|
| 266 | groupType: -2147483643
|
|---|
| 267 | isCriticalSystemObject: TRUE
|
|---|
| 268 |
|
|---|
| 269 | dn: CN=Print Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 270 | objectClass: top
|
|---|
| 271 | objectClass: group
|
|---|
| 272 | description: Members can administer domain printers
|
|---|
| 273 | objectSid: S-1-5-32-550
|
|---|
| 274 | adminCount: 1
|
|---|
| 275 | sAMAccountName: Print Operators
|
|---|
| 276 | systemFlags: -1946157056
|
|---|
| 277 | groupType: -2147483643
|
|---|
| 278 | isCriticalSystemObject: TRUE
|
|---|
| 279 |
|
|---|
| 280 | dn: CN=Backup Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 281 | objectClass: top
|
|---|
| 282 | objectClass: group
|
|---|
| 283 | description: Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
|
|---|
| 284 | objectSid: S-1-5-32-551
|
|---|
| 285 | adminCount: 1
|
|---|
| 286 | sAMAccountName: Backup Operators
|
|---|
| 287 | systemFlags: -1946157056
|
|---|
| 288 | groupType: -2147483643
|
|---|
| 289 | isCriticalSystemObject: TRUE
|
|---|
| 290 |
|
|---|
| 291 | dn: CN=Replicator,CN=Builtin,${DOMAINDN}
|
|---|
| 292 | objectClass: top
|
|---|
| 293 | objectClass: group
|
|---|
| 294 | description: Supports file replication in a domain
|
|---|
| 295 | objectSid: S-1-5-32-552
|
|---|
| 296 | adminCount: 1
|
|---|
| 297 | sAMAccountName: Replicator
|
|---|
| 298 | systemFlags: -1946157056
|
|---|
| 299 | groupType: -2147483643
|
|---|
| 300 | isCriticalSystemObject: TRUE
|
|---|
| 301 |
|
|---|
| 302 | dn: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,${DOMAINDN}
|
|---|
| 303 | objectClass: top
|
|---|
| 304 | objectClass: group
|
|---|
| 305 | description: A backward compatibility group which allows read access on all users and groups in the domain
|
|---|
| 306 | member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 307 | objectSid: S-1-5-32-554
|
|---|
| 308 | sAMAccountName: Pre-Windows 2000 Compatible Access
|
|---|
| 309 | systemFlags: -1946157056
|
|---|
| 310 | groupType: -2147483643
|
|---|
| 311 | isCriticalSystemObject: TRUE
|
|---|
| 312 |
|
|---|
| 313 | dn: CN=Remote Desktop Users,CN=Builtin,${DOMAINDN}
|
|---|
| 314 | objectClass: top
|
|---|
| 315 | objectClass: group
|
|---|
| 316 | description: Members in this group are granted the right to logon remotely
|
|---|
| 317 | objectSid: S-1-5-32-555
|
|---|
| 318 | sAMAccountName: Remote Desktop Users
|
|---|
| 319 | systemFlags: -1946157056
|
|---|
| 320 | groupType: -2147483643
|
|---|
| 321 | isCriticalSystemObject: TRUE
|
|---|
| 322 |
|
|---|
| 323 | dn: CN=Network Configuration Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 324 | objectClass: top
|
|---|
| 325 | objectClass: group
|
|---|
| 326 | description: Members in this group can have some administrative privileges to manage configuration of networking features
|
|---|
| 327 | objectSid: S-1-5-32-556
|
|---|
| 328 | sAMAccountName: Network Configuration Operators
|
|---|
| 329 | systemFlags: -1946157056
|
|---|
| 330 | groupType: -2147483643
|
|---|
| 331 | isCriticalSystemObject: TRUE
|
|---|
| 332 |
|
|---|
| 333 | dn: CN=Incoming Forest Trust Builders,CN=Builtin,${DOMAINDN}
|
|---|
| 334 | objectClass: top
|
|---|
| 335 | objectClass: group
|
|---|
| 336 | description: Members of this group can create incoming, one-way trusts to this forest
|
|---|
| 337 | objectSid: S-1-5-32-557
|
|---|
| 338 | sAMAccountName: Incoming Forest Trust Builders
|
|---|
| 339 | systemFlags: -1946157056
|
|---|
| 340 | groupType: -2147483643
|
|---|
| 341 | isCriticalSystemObject: TRUE
|
|---|
| 342 |
|
|---|
| 343 | dn: CN=Performance Monitor Users,CN=Builtin,${DOMAINDN}
|
|---|
| 344 | objectClass: top
|
|---|
| 345 | objectClass: group
|
|---|
| 346 | description: Members of this group can access performance counter data locally and remotely
|
|---|
| 347 | objectSid: S-1-5-32-558
|
|---|
| 348 | sAMAccountName: Performance Monitor Users
|
|---|
| 349 | systemFlags: -1946157056
|
|---|
| 350 | groupType: -2147483643
|
|---|
| 351 | isCriticalSystemObject: TRUE
|
|---|
| 352 |
|
|---|
| 353 | dn: CN=Performance Log Users,CN=Builtin,${DOMAINDN}
|
|---|
| 354 | objectClass: top
|
|---|
| 355 | objectClass: group
|
|---|
| 356 | description: Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer
|
|---|
| 357 | objectSid: S-1-5-32-559
|
|---|
| 358 | sAMAccountName: Performance Log Users
|
|---|
| 359 | systemFlags: -1946157056
|
|---|
| 360 | groupType: -2147483643
|
|---|
| 361 | isCriticalSystemObject: TRUE
|
|---|
| 362 |
|
|---|
| 363 | dn: CN=Windows Authorization Access Group,CN=Builtin,${DOMAINDN}
|
|---|
| 364 | objectClass: top
|
|---|
| 365 | objectClass: group
|
|---|
| 366 | description: Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects
|
|---|
| 367 | member: CN=S-1-5-9,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 368 | objectSid: S-1-5-32-560
|
|---|
| 369 | sAMAccountName: Windows Authorization Access Group
|
|---|
| 370 | systemFlags: -1946157056
|
|---|
| 371 | groupType: -2147483643
|
|---|
| 372 | isCriticalSystemObject: TRUE
|
|---|
| 373 |
|
|---|
| 374 | dn: CN=Terminal Server License Servers,CN=Builtin,${DOMAINDN}
|
|---|
| 375 | objectClass: top
|
|---|
| 376 | objectClass: group
|
|---|
| 377 | description: Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage
|
|---|
| 378 | objectSid: S-1-5-32-561
|
|---|
| 379 | sAMAccountName: Terminal Server License Servers
|
|---|
| 380 | systemFlags: -1946157056
|
|---|
| 381 | groupType: -2147483643
|
|---|
| 382 | isCriticalSystemObject: TRUE
|
|---|
| 383 |
|
|---|
| 384 | dn: CN=Distributed COM Users,CN=Builtin,${DOMAINDN}
|
|---|
| 385 | objectClass: top
|
|---|
| 386 | objectClass: group
|
|---|
| 387 | description: Members are allowed to launch, activate and use Distributed COM objects on this machine.
|
|---|
| 388 | objectSid: S-1-5-32-562
|
|---|
| 389 | sAMAccountName: Distributed COM Users
|
|---|
| 390 | systemFlags: -1946157056
|
|---|
| 391 | groupType: -2147483643
|
|---|
| 392 | isCriticalSystemObject: TRUE
|
|---|
| 393 |
|
|---|
| 394 | dn: CN=IIS_IUSRS,CN=Builtin,${DOMAINDN}
|
|---|
| 395 | objectClass: top
|
|---|
| 396 | objectClass: group
|
|---|
| 397 | description: Built-in group used by Internet Information Services.
|
|---|
| 398 | member: CN=S-1-5-17,CN=ForeignSecurityPrincipals,${DOMAINDN}
|
|---|
| 399 | objectSid: S-1-5-32-568
|
|---|
| 400 | sAMAccountName: IIS_IUSRS
|
|---|
| 401 | systemFlags: -1946157056
|
|---|
| 402 | groupType: -2147483643
|
|---|
| 403 | isCriticalSystemObject: TRUE
|
|---|
| 404 |
|
|---|
| 405 | dn: CN=Cryptographic Operators,CN=Builtin,${DOMAINDN}
|
|---|
| 406 | objectClass: top
|
|---|
| 407 | objectClass: group
|
|---|
| 408 | description: Members are authorized to perform cryptographic operations.
|
|---|
| 409 | objectSid: S-1-5-32-569
|
|---|
| 410 | sAMAccountName: Cryptographic Operators
|
|---|
| 411 | systemFlags: -1946157056
|
|---|
| 412 | groupType: -2147483643
|
|---|
| 413 | isCriticalSystemObject: TRUE
|
|---|
| 414 |
|
|---|
| 415 | dn: CN=Event Log Readers,CN=Builtin,${DOMAINDN}
|
|---|
| 416 | objectClass: top
|
|---|
| 417 | objectClass: group
|
|---|
| 418 | description: Members of this group can read event logs from local machine
|
|---|
| 419 | objectSid: S-1-5-32-573
|
|---|
| 420 | sAMAccountName: Event Log Readers
|
|---|
| 421 | systemFlags: -1946157056
|
|---|
| 422 | groupType: -2147483643
|
|---|
| 423 | isCriticalSystemObject: TRUE
|
|---|
| 424 |
|
|---|
| 425 | dn: CN=Certificate Service DCOM Access,CN=Builtin,${DOMAINDN}
|
|---|
| 426 | objectClass: top
|
|---|
| 427 | objectClass: group
|
|---|
| 428 | description: Members of this group are allowed to connect to Certification Authorities in the enterprise
|
|---|
| 429 | objectSid: S-1-5-32-574
|
|---|
| 430 | sAMAccountName: Certificate Service DCOM Access
|
|---|
| 431 | systemFlags: -1946157056
|
|---|
| 432 | groupType: -2147483643
|
|---|
| 433 | isCriticalSystemObject: TRUE
|
|---|
| 434 |
|
|---|
| 435 | # Add well known security principals
|
|---|
| 436 |
|
|---|
| 437 | dn: CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 438 | objectClass: top
|
|---|
| 439 | objectClass: container
|
|---|
| 440 | systemFlags: -2147483648
|
|---|
| 441 |
|
|---|
| 442 | dn: CN=Anonymous Logon,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 443 | objectClass: top
|
|---|
| 444 | objectClass: foreignSecurityPrincipal
|
|---|
| 445 | objectSid: S-1-5-7
|
|---|
| 446 |
|
|---|
| 447 | dn: CN=Authenticated Users,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 448 | objectClass: top
|
|---|
| 449 | objectClass: foreignSecurityPrincipal
|
|---|
| 450 | objectSid: S-1-5-11
|
|---|
| 451 |
|
|---|
| 452 | dn: CN=Batch,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 453 | objectClass: top
|
|---|
| 454 | objectClass: foreignSecurityPrincipal
|
|---|
| 455 | objectSid: S-1-5-3
|
|---|
| 456 |
|
|---|
| 457 | dn: CN=Creator Group,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 458 | objectClass: top
|
|---|
| 459 | objectClass: foreignSecurityPrincipal
|
|---|
| 460 | objectSid: S-1-3-1
|
|---|
| 461 |
|
|---|
| 462 | dn: CN=Creator Owner,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 463 | objectClass: top
|
|---|
| 464 | objectClass: foreignSecurityPrincipal
|
|---|
| 465 | objectSid: S-1-3-0
|
|---|
| 466 |
|
|---|
| 467 | dn: CN=Dialup,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 468 | objectClass: top
|
|---|
| 469 | objectClass: foreignSecurityPrincipal
|
|---|
| 470 | objectSid: S-1-5-1
|
|---|
| 471 |
|
|---|
| 472 | dn: CN=Digest Authentication,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 473 | objectClass: top
|
|---|
| 474 | objectClass: foreignSecurityPrincipal
|
|---|
| 475 | objectSid: S-1-5-64-21
|
|---|
| 476 |
|
|---|
| 477 | dn: CN=Enterprise Domain Controllers,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 478 | objectClass: top
|
|---|
| 479 | objectClass: foreignSecurityPrincipal
|
|---|
| 480 | objectSid: S-1-5-9
|
|---|
| 481 |
|
|---|
| 482 | dn: CN=Everyone,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 483 | objectClass: top
|
|---|
| 484 | objectClass: foreignSecurityPrincipal
|
|---|
| 485 | objectSid: S-1-1-0
|
|---|
| 486 |
|
|---|
| 487 | dn: CN=Interactive,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 488 | objectClass: top
|
|---|
| 489 | objectClass: foreignSecurityPrincipal
|
|---|
| 490 | objectSid: S-1-5-4
|
|---|
| 491 |
|
|---|
| 492 | dn: CN=IUSR,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 493 | objectClass: top
|
|---|
| 494 | objectClass: foreignSecurityPrincipal
|
|---|
| 495 | objectSid: S-1-5-17
|
|---|
| 496 |
|
|---|
| 497 | dn: CN=Local Service,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 498 | objectClass: top
|
|---|
| 499 | objectClass: foreignSecurityPrincipal
|
|---|
| 500 | objectSid: S-1-5-19
|
|---|
| 501 |
|
|---|
| 502 | dn: CN=Network,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 503 | objectClass: top
|
|---|
| 504 | objectClass: foreignSecurityPrincipal
|
|---|
| 505 | objectSid: S-1-5-2
|
|---|
| 506 |
|
|---|
| 507 | dn: CN=Network Service,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 508 | objectClass: top
|
|---|
| 509 | objectClass: foreignSecurityPrincipal
|
|---|
| 510 | objectSid: S-1-5-20
|
|---|
| 511 |
|
|---|
| 512 | dn: CN=NTLM Authentication,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 513 | objectClass: top
|
|---|
| 514 | objectClass: foreignSecurityPrincipal
|
|---|
| 515 | objectSid: S-1-5-64-10
|
|---|
| 516 |
|
|---|
| 517 | dn: CN=Other Organization,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 518 | objectClass: top
|
|---|
| 519 | objectClass: foreignSecurityPrincipal
|
|---|
| 520 | objectSid: S-1-5-1000
|
|---|
| 521 |
|
|---|
| 522 | dn: CN=Owner Rights,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 523 | objectClass: top
|
|---|
| 524 | objectClass: foreignSecurityPrincipal
|
|---|
| 525 | objectSid: S-1-3-4
|
|---|
| 526 |
|
|---|
| 527 | dn: CN=Proxy,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 528 | objectClass: top
|
|---|
| 529 | objectClass: foreignSecurityPrincipal
|
|---|
| 530 | objectSid: S-1-5-8
|
|---|
| 531 |
|
|---|
| 532 | dn: CN=Remote Interactive Logon,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 533 | objectClass: top
|
|---|
| 534 | objectClass: foreignSecurityPrincipal
|
|---|
| 535 | objectSid: S-1-5-14
|
|---|
| 536 |
|
|---|
| 537 | dn: CN=Restricted,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 538 | objectClass: top
|
|---|
| 539 | objectClass: foreignSecurityPrincipal
|
|---|
| 540 | objectSid: S-1-5-12
|
|---|
| 541 |
|
|---|
| 542 | dn: CN=SChannel Authentication,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 543 | objectClass: top
|
|---|
| 544 | objectClass: foreignSecurityPrincipal
|
|---|
| 545 | objectSid: S-1-5-64-14
|
|---|
| 546 |
|
|---|
| 547 | dn: CN=Self,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 548 | objectClass: top
|
|---|
| 549 | objectClass: foreignSecurityPrincipal
|
|---|
| 550 | objectSid: S-1-5-10
|
|---|
| 551 |
|
|---|
| 552 | dn: CN=Service,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 553 | objectClass: top
|
|---|
| 554 | objectClass: foreignSecurityPrincipal
|
|---|
| 555 | objectSid: S-1-5-6
|
|---|
| 556 |
|
|---|
| 557 | dn: CN=System,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 558 | objectClass: top
|
|---|
| 559 | objectClass: foreignSecurityPrincipal
|
|---|
| 560 | objectSid: S-1-5-18
|
|---|
| 561 |
|
|---|
| 562 | dn: CN=Terminal Server User,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 563 | objectClass: top
|
|---|
| 564 | objectClass: foreignSecurityPrincipal
|
|---|
| 565 | objectSid: S-1-5-13
|
|---|
| 566 |
|
|---|
| 567 | dn: CN=This Organization,CN=WellKnown Security Principals,${CONFIGDN}
|
|---|
| 568 | objectClass: top
|
|---|
| 569 | objectClass: foreignSecurityPrincipal
|
|---|
| 570 | objectSid: S-1-5-15
|
|---|
