Active Directory Security dot com

Complete Coverage of Delegation, Security Audit & Compliance Reporting in Active Directory

Brought to you by former Microsoft Program Manager for Active Directory Security
REFERENCE GUIDANCE REPORTING
Reference | Top-20 D | Risks | FAQ Delegate | Verify | Assess | Audit | Report | Comply Reports |  Tools
| Overview | Pitfalls | Challenges | How to Report Delegated Access in AD |




How to Report Delegated Access in Active Directory




Organizations can accurately report delegated access grants in Active Directory by following a simple 3 step process –


Step 1 – Identify the scope of the assessment, which could be an individual object, a tree of objects, or an entire domain.

Step 2 – Identify the administrative tasks that you wish to include in your delegated access report.

Step 3 – Proceed to accurately determine who can perform these tasks in the identified scope.

        NOTE – Compile your assessment in the form of a delegation/access report.



The process of determining delegated access on these objects can be performed manually or via an automated solution –


Option 1 – Manually Report Delegated Access
    (Approximate time needed per object – 30 minutes)


  1. Launch Active Directory Users and Computers

    (To do so, click on Start, then click on Run, then type "dsa.msc" in the box and finally press Enter)
  2. Click on the View option in the Menu bar and select the Advanced Features option.
  3. Navigate to the specific user account or security group on which you wish to generate your report.
  4. Right-click on the object and select Properties.
  5. Navigate to the Security Tab by clicking on it.
  6. Click the Advanced button to open the Advanced Security Settings pane.
  7. Take every entry in the Permission entries field into account identical to how an actual access check is performed in Active Directory to determine who is delegated which tasks on this object.

    The precise details are complicated, but following are some helpful pointers to take into account –

    1. A recommended starting point is to figure out if there are any Deny permissions specified.
    2. Then, look for any Allow permission entries that seem to conflict with Deny permissions.
    3. Meticulously intersect every set of effective conflicting permissions, keeping in mind that Explicit permissions override Inherited ones.
    4. Expand every group membership specified in every relevant ACE, as users could belong to multiple groups with conflicting permissions.
    5. Dynamically evaluate the membership of every well-known SID encountered in ACEs.
    6. Check Schema to determine if authorized objects creations are in fact permissible.
    7. In this manner, include every relevant detail to precisely simulate a real access check.
    Upon the successful completion of this step, you will have successfully reported your delegation.
  8. Click the Okay button to return to the object's Security tab of the Properties pane.
  9. Click the Okay button to return to Active Directory Users and Computers main application panel.
  10. Close the Active Directory Users and Computers main application panel.
Option 2 – Use an Automated Solution
    (Approximate time needed per object – 30 seconds)


  1. Launch Gold Finger.

    (To do so, click on Start, then click on Programs, then on Paramount Defenses, then on Gold Finger)
  2. Select the administrative tasks whose delegations you wish to include in your delegation report.
  3. Specify the scope of your assessment by entering the distinguished name of the target AD object/tree.
  4. Press Enter or click the Gold Finger button.
  5. Results pane will list the identities of all individuals who can perform this task in the specified scope.
  6. Click on Print to print your delegation report.
DEMO – To view a brief demo, please click here
Gold Finger - Microsoft-endorsed, Active Directory Resultant Access/Security Auditing/Reporting Tool
About Copyright ActiveDirSec.Com 2008 – 2011. All Rights Reserved Disclaimer
Active Directory Security Active Directory Reports Active Directory Reporting Tools Cyber Security and Global Security
Active Directory Audit Tool Active Directory Reporting Tool Active Directory Reporting Tools Active Directory Effective Permissions