ADMINISTRATIVE TASK
. | HOW TO DELEGATE THE TASK
. | SECURITY IMPLICATIONS OF TASK
(when performed with malicious intent) |
|
1. Create an organizational
unit | Grant Create Child permissions on the parent object to create Organizational Unit objects | Create unauthorized user accounts, computer accounts and security groups, and use them to weaken security |
|
2. Delete an organizational
unit | Grant Standard Delete permissions on the OU object or Delete Child permissions on the parent object | Delete all user accounts, security groups and computers in the OU. |
|
3. Change list of GPOs linked
to an organizational unit | Grant Write Property permissions on the OU object to modify the GP-Link attribute and the GP-Options attribute | Weaken security policies protecting all accounts and computers receiving policy in the OU. |
|
4. Disable GPOs linked to an
organizational unit | Grant Write Property permissions on the OU object to modify GP-Link attribute and the GP-Options attribute | Weaken security policies protecting all accounts and computers receiving policy in the OU. |
|
5. Change precedence of GPOs
linked to an organizational
unit | Grant Write Property permissions on the OU object to modify GP-Options attribute and the GP-Options attribute | Weaken security policies protecting all accounts and computers receiving policy in the OU. |
|