Can Domain Admin stop Enterprise Admin from peeping into a domain

Discussion in 'Active Directory' started by WJ, Nov 21, 2003.

  1. WJ

    WJ Guest

    I know in AD 2003, a Domain admin can exclude Enterprise admin from messing
    around with everything that lives in domain. Will EA be able to take
    ownership of everything if he wants to even if is blocked ?

    Thanks

    John
     
    WJ, Nov 21, 2003
    #1
    1. Advertisements

  2. EntAdmins are gods. Yes, they can take ownership, update DACLs and do
    whatever they want. The only way to deal with this is to setup auditing and
    flush logs to an external store frequently (so that the nasty EA does not
    clear it).

    Ultimate solution is to setup a separate forest. Forests are security
    boundaries, not domains.

    Another note: you should trust your admins or fire them.

    --
    Dmitri Gavrilov
    SDE, Active Directory Core

    This posting is provided "AS IS" with no warranties, and confers no rights.
    Use of included script samples are subject to the terms specified at
    http://www.microsoft.com/info/cpyright.htm
     
    Dmitri Gavrilov [MSFT], Nov 21, 2003
    #2
    1. Advertisements

  3. WJ

    WJ Guest

    Yes. In God We Trust! :)

    Thanks Dmitri

    John Webb
     
    WJ, Nov 21, 2003
    #3
  4. :) Right.

    BTW, Domain Admins are gods too. In the whole forest. It is quite a bit
    harder for them to use their powers, but a clever admin can achieve what he
    wants.

    And anybody who has physical access to the DC is also a god. Again, he has
    to be very clever.

    --
    Dmitri Gavrilov
    SDE, Active Directory Core

    This posting is provided "AS IS" with no warranties, and confers no rights.
    Use of included script samples are subject to the terms specified at
    http://www.microsoft.com/info/cpyright.htm
     
    Dmitri Gavrilov [MSFT], Nov 21, 2003
    #4
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.