Active Directory Security Model

Active Directory's security model secures and protects every object stored in Active Directory, including domain user accounts and domain computer accounts, domain security groups and group policies.

It allows administrators to specify who has what access to which object to a high degree of control. It also allows administrators to specify access for an entire group of users so as to simply security management.

The following is an overview of how Active Directory's security model protects stored content –

1. Each object is protected by a Security Descriptor

2. Each security descriptor contains an Access Control List (ACL)

3. Each ACL contains numerous Access Control Entries (ACEs)

4. Each ACE allows or denies specified security permissions to some user or security group

5. Security groups can be transitively nested into other security groups

6. ACEs can be explicit or inherited; explicit ACEs override inherited ACEs

7. Access is specified in the form of low–level technical permissions

8. These low-level permissions can be standard permissions, extended rights or validated writes

9. Active Directory's current object visibility mode impacts list access requests

10. The access check takes into account the object's DACL and the user's security token and determines the resultant authorized access for the user on the object

In this manner, Active Directory's security model secures and protects Active Directory content.

The Gold Finger Active Directory Reporting Tool from Paramount Defenses can be used to instantly find out where all a user or group has what security permissions in Active Directory. You can specify the exact permissions you are looking for and the OU/container/domain you wish to look for permissions in. You can also export all results to CSV files as well as evaluate complete nested group memberships.

How to Instantly Analyze Permissions in Active Directory – A Demo