0byt3m1n1
Path:
C:
/
Windows
/
ADAM
/
[
Home
]
File: adamschema.ini
;/*++ ; ;Copyright (c) 1989-1998 Microsoft Corporation ; ;Module Name: ; ; Schema.INI ; Used for Configuring the DIT at install time ; ;Abstract: ;----- ; Contains the information necessary to set up the default objects in an ; installed DIT. Covers the following cases: ; ; 1) First DS in the first site ; 2) First DS in any other site. ; 3) Replicated DS in an existing site. ; ;Notes: ;----- ; For each object, by default, the RDN is picked up from the section name. ; To override this, you can add the line RDN-Of-Object=<RDN> in the section ; This is useful when you need two objects with the same RDN (but not DN). In ; this case, name the sections differently (since two sections in an ini file ; cannot be named the same, or only the first one will be picked up always), but ; add the RDN-Of-Object key to the section with the duplicate RDN appropriately. ; As an example, look at the sections System and Well-Known-Security-Id-System, ; both of which has the RDN System. ; ;--*/ ;--------------------------------------------------------- ; DEFAULT STRUCTURE OF THE ENTERPRISE DIT ;--------------------------------------------------------- ;!-------------------------------------------------------- ;! The tree under the default configuration container ;!-------------------------------------------------------- [DEFAULTCONFIGNC] objectClass=Configuration ObjectCategory=Configuration ;Its a NC ROOT - (NC_MASTER_SUBREF) instanceType=5 msDS-ReplAuthenticationMode=$REGISTRY=DefaultReplAuthenticationMode nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EA)(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;SA)(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;SA)(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;SA)(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;SA)(A;;LCRPLORC;;;SA)S:(AU;CISAFA;WDWOSDDTWPCRCCDCSW;;;WD) ShowInAdvancedViewOnly=True wellKnownObjects=$EMBEDDED:32:18e2ea80684f11d2b9aa00c04f79f805:cn=Deleted Objects,<Configuration NC wellKnownObjects=$EMBEDDED:32:ab8153b7768811d1aded00c04fd8d5cd:cn=LostAndFoundConfig,<Configuration NC wellKnownObjects=$EMBEDDED:32:6227f0af1fc2410d8e3bb10615bb5b0f:cn=NTDS Quotas,<Configuration NC wellKnownObjects=$EMBEDDED:32:22b70c67d56e4efb91e9300fca3dc1aa:cn=ForeignSecurityPrincipals,<Configuration NC wellKnownObjects=$EMBEDDED:32:a9d1ca15768811d1aded00c04fd8d5cd:cn=Roles,<Configuration NC objectSid=DO CHILD=Deleted Objects ; lost and found objects CHILD=LostAndFoundConfig CHILD=Sites CHILD=Partitions CHILD=Services ;Container for Control Access Rights CHILD=Extended-Rights ; for Adprep CHILD=DirectoryUpdates CHILD=NTDS Quotas config CHILD=ForeignSecurityPrincipals ; ADAM roles -- ADAM groups container CHILD=Roles [Deleted Objects] ; NOTE: This section is used for three objects, the Deleted Objects container ; in Root Domain NC and the deleted objects container in the Config NC. nTSecurityDescriptor=O:EAG:EAD:P(A;;RPWPCCDCLCSWRCWDWOSD;;;EA)(A;;RPLCLORC;;;DG)S: objectClass =container ObjectCategory =container description=Default container for deleted objects showInAdvancedViewOnly=True isDeleted=True isCriticalSystemObject=True ;systemFlags=FLAG_CONFIG_DISALLOW_RENAME | ; FLAG_CONFIG_DISALLOW_MOVE | ; FLAG_DISALLOW_DELETE systemFlags=0x8C000000 ;-------------------------------------------------------- ; LostAndFoundConfig subtree under the default configuration container ;-------------------------------------------------------- [LostAndFoundConfig] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA) objectClass=lostAndFound ObjectCategory=Lost-And-Found ShowInAdvancedViewOnly=True ; FLAG_DISALLOW_DELETE systemFlags=0x80000000 ;-------------------------------------------------------- ; Sites subtree under the default configuration container ;-------------------------------------------------------- [Sites] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA)(A;CI;RPLCLORC;;;DG)(A;CI;RPLCLORC;;;SA)(OA;CIIO;RPWP;72e39547-7b18-11d1-adef-00c04fd8d5cd;bf967a92-0de6-11d0-a285-00aa003049e2;SA)S:(AU;CISA;CCDCSDDT;;;WD)(OU;CIIOSA;CR;;f0f8ffab-1191-11d0-a060-00aa006c33ed;WD)(OU;CIIOSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967ab3-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967ab3-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOSA;WP;3e10944c-c354-11d0-aff8-0000f80367c1;b7b13124-b82e-11d0-afee-0000f80367c1;WD) objectClass = sitesContainer ObjectCategory = Sites-Container cn = Sites ShowInAdvancedViewOnly=True ; FLAG_DISALLOW_DELETE ; FLAG_DISALLOW_MOVE_ON_DELETE systemFlags=0x82000000 CHILD=Subnets CHILD=Inter-Site Transports CHILD=$REGISTRY=InstallSiteName [Subnets] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA) objectClass = subnetContainer ObjectCategory = Subnet-Container cn = Subnets ShowInAdvancedViewOnly=True ; FLAG_DISALLOW_DELETE systemFlags=0x80000000 [Inter-Site Transports] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA) objectClass = interSiteTransportContainer ObjectCategory = Inter-Site-Transport-Container cn = Inter-Site Transports ShowInAdvancedViewOnly=True ; FLAG_DISALLOW_DELETE systemFlags=0x80000000 CHILD=IP [IP] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA) objectClass = interSiteTransport ObjectCategory = Inter-Site-Transport cn = IP ShowInAdvancedViewOnly=True transportAddressAttribute = dNSHostName transportDllName = ismip.dll ; FLAG_DISALLOW_DELETE systemFlags=0x80000000 CHILD=DEFAULTIPSITELINK [DEFAULTIPSITELINK] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA) objectClass = siteLink ObjectCategory = Site-Link cn = DefaultIpSiteLink ShowInAdvancedViewOnly=True ; The replication period is every (cost) intervals, where an interval is 15 ; minutes. cost=100 replInterval=180 siteList= $REGISTRY=InstallSiteDn [$REGISTRY=InstallSiteName] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;LCRPLORC;;;SA) objectClass = Site ObjectCategory = Site cn = $REGISTRY=InstallSiteName ShowInAdvancedViewOnly=True ;systemFlags=FLAG_CONFIG_ALLOW_RENAME ; FLAG_DISALLOW_MOVE_ON_DELETE systemFlags=0x42000000 CHILD=NTDS Site Settings CHILD=Servers [NTDS Site Settings] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSDDTSW;;;EA) objectClass = nTDSSiteSettings ObjectCategory = NTDS-Site-Settings cn = NTDS Site Settings ShowInAdvancedViewOnly=True Schedule=$SYSDEFAULT=REPLSCHEDULE [Servers] nTSecurityDescriptor=O:EAG:EAD:(A;;CC;;;EA)(A;;RPLCLORC;;;DG) objectClass = serversContainer ObjectCategory = Servers-Container cn = Servers ShowInAdvancedViewOnly=True ;systemFlags=FLAG_DISALLOW_MOVE_ON_DELETE systemFlags=0x02000000 ;-------------------------------------------------------- ; Partitions subtree under the default configuration container ;-------------------------------------------------------- [Partitions] nTSecurityDescriptor=O:EAG:EAD:(A;;LCLORC;;;DG)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;DG)(OA;;RP;d31a8757-2447-4545-8081-3bb610cacbf2;;DG)(OA;;RP;66171887-8f3c-11d0-afda-00c04fd930c9;;DG)(OA;;RP;032160bf-9824-11d1-aec0-0000f80367c1;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA)(A;;CC;;;SA)S:(AU;CISA;WDWOCRWPCCDCSDDT;;;WD) objectClass =crossRefContainer ObjectCategory =Cross-Ref-Container ShowInAdvancedViewOnly=True msDs-Behavior-Version=$REGISTRY=InstallForestBehaviorVersion fSMORoleOwner=$REGISTRY=Machine DN Name ; FLAG_DISALLOW_DELETE systemFlags=0x80000000 CHILD=Enterprise Configuration CHILD=Enterprise Schema [Enterprise Configuration] nTSecurityDescriptor=O:EAG:EAD: objectClass=crossRef ObjectCategory=Cross-Ref nCName=$REGISTRY=Configuration NC systemFlags=1 ShowInAdvancedViewOnly=True [Enterprise Schema] nTSecurityDescriptor=O:EAG:EAD: objectClass=crossRef ObjectCategory=Cross-Ref nCName=$REGISTRY=Schema DN Name systemFlags=1 ShowInAdvancedViewOnly=True ;-------------------------------------------------------- ; Services subtree under the default configuration container ;-------------------------------------------------------- [Services] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA) objectClass=Container ObjectCategory=Container ShowInAdvancedViewOnly=True ; FLAG_DISALLOW_DELETE systemFlags=0x80000000 CHILD=Windows NT ;-------------------------------------------------------- ; Windows NT subtree under the Services subtree ;-------------------------------------------------------- [Windows NT] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA) objectClass=Container ObjectCategory=Container ShowInAdvancedViewOnly=True ; FLAG_DISALLOW_DELETE systemFlags=0x80000000 CHILD=Directory Service [Directory Service] nTSecurityDescriptor=O:EAG:EAD:(A;CI;RPLCLORC;;;DG)(A;CI;RPWPCRLCLOCCRCWDWOSW;;;EA)S:(OU;SA;WP;f0f8ff86-1191-11d0-a060-00aa006c33ed;;WD) objectClass=nTDSService ObjectCategory=NTDS-Service ShowInAdvancedViewOnly=True msDS-Other-Settings=DynamicObjectDefaultTTL=86400 msDS-Other-Settings=DynamicObjectMinTTL=900 msDS-Other-Settings=DisableVLVSupport=0 msDS-Other-Settings=RequireSecureSimpleBind=0 msDS-Other-Settings=RequireSecureProxyBind=1 msDS-Other-Settings=ADAMDisablePasswordPolicies=0 msDS-Other-Settings=ADAMDisableLogonAuditing=0 msDS-Other-Settings=ADAMLastLogonTimestampWindow=7 msDS-Other-Settings=MaxReferrals=3 msDS-Other-Settings=ReferralRefreshInterval=5 msDS-Other-Settings=SelfReferralsOnly=0 msDS-Other-Settings=ADAMAllowADAMSecurityPrincipalsInConfigPartition=0 msDS-Other-Settings=ADAMDisableSPNRegistration=0 ; Explict TSL default set in W2K3 SP1 to increase shelf-life of backups and allow longer ; disconnection times. tombstoneLifetime=180 ; FLAG_DISALLOW_DELETE systemFlags=0x80000000 CHILD=Query-Policies CHILD=SCP Publication Service [Query-Policies] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA) objectClass=Container ObjectCategory=Container ShowInAdvancedViewOnly=True CHILD=Default Query Policy [Default Query Policy] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCDCRCWDWOSW;;;EA)S:(OU;SA;WP;7359a352-90f7-11d1-aebc-0000f80367c1;;WD) objectClass=queryPolicy ObjectCategory=Query-Policy ShowInAdvancedViewOnly=True lDAPAdminLimits=MaxConnections=5000 lDAPAdminLimits=InitRecvTimeout=120 lDAPAdminLimits=MaxConnIdleTime=900 lDAPAdminLimits=MaxActiveQueries=20 lDAPAdminLimits=MaxNotificationPerConn=5 lDAPAdminLimits=MaxPageSize=1000 lDAPAdminLimits=MaxQueryDuration=120 lDAPAdminLimits=MaxTempTableSize=10000 lDAPAdminLimits=MaxResultSetSize=262144 lDAPAdminLimits=MaxPoolThreads=4 lDAPAdminLimits=MaxDatagramRecv=4096 lDAPAdminLimits=MaxReceiveBuffer=10485760 [SCP Publication Service] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA) objectClass=msDS-ServiceConnectionPointPublicationService ObjectCategory=ms-DS-Service-Connection-Point-Publication-Service Enabled=TRUE ; FLAG_DISALLOW_DELETE systemFlags=0x80000000 ;-------------------------------------------------------- ; Extended Rights subtree under the default configuration container ; ; The localizationDisplayId in each extended-rights objects is used to index into ; a .mc file, extrts.mc, to get the localized displayName for the objects for UI ; purposes. Do not change them. if you add/remove an extended-rights, or change the ; displayName, make sure to change the file (enlist or ask the shell team to do this) ; \\rastaman\ntwin\src\shell\security\dssec\extrts.mc appropriately as per instructions ; there. For an extended-right add, you should look at this file first to see what ; localization-display-id you should use. ; ; In source depot, \nt\shell\osshell\security\dssec\extrts.mc ; ;-------------------------------------------------------- [Extended-Rights] nTSecurityDescriptor=O:EAG:EAD:(A;CI;RPLCLORC;;;DG)(A;CI;RPWPCRLCLOCCDCRCWDWOSW;;;EA) objectClass = Container ObjectCategory = Container cn = Extended-Rights ShowInAdvancedViewOnly=True ; FLAG_DISALLOW_DELETE systemFlags=0x80000000 CHILD=General-Information CHILD=User-Account-Restrictions CHILD=User-Logon CHILD=Membership CHILD=Email-Information CHILD=Personal-Information CHILD=Web-Information CHILD=DS-Replication-Get-Changes CHILD=DS-Replication-Synchronize CHILD=DS-Replication-Manage-Topology CHILD=User-Change-Password CHILD=User-Force-Change-Password CHILD=Self-Membership CHILD=Unexpire-Password CHILD=Change-Schema-Master CHILD=Do-Garbage-Collection CHILD=Add-GUID CHILD=Change-Naming-Master CHILD=Public-Information CHILD=DS-Install-Replica CHILD=Update-Schema-Cache CHILD=Recalculate-Security-Inheritance CHILD=DS-Replication-Get-Changes-All CHILD=Reanimate-Tombstones CHILD=DS-Execute-Intentions-Script CHILD=DS-Replication-Monitor-Topology CHILD=DS-Query-Self-Quota CHILD=Reload-SSL-Certificate [General-Information] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967aba-0de6-11d0-a285-00aa003049e2 appliesTo=4828CC14-1437-45bc-9B07-AD6F015E5F28 displayName=General Information localizationDisplayId=8 rightsGUID=59ba2f42-79a2-11d0-9020-00c04fc2d3cf validAccesses=0x30 [User-Account-Restrictions] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967aba-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a86-0de6-11d0-a285-00aa003049e2 appliesTo=4828CC14-1437-45bc-9B07-AD6F015E5F28 displayName=Account Restrictions localizationDisplayId=9 rightsGUID=4c164200-20c0-11d0-a768-00aa006e0529 validAccesses=0x30 [User-Logon] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967aba-0de6-11d0-a285-00aa003049e2 appliesTo=4828CC14-1437-45bc-9B07-AD6F015E5F28 displayName=Logon Information localizationDisplayId=10 rightsGUID=5f202010-79a5-11d0-9020-00c04fc2d4cf validAccesses=0x30 [Membership] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967aba-0de6-11d0-a285-00aa003049e2 appliesTo=4828CC14-1437-45bc-9B07-AD6F015E5F28 displayName=Group Membership localizationDisplayId=11 rightsGUID=bc0ac240-79a9-11d0-9020-00c04fc2d4cf validAccesses=0x30 [Email-Information] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967aba-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a9c-0de6-11d0-a285-00aa003049e2 appliesTo=4828CC14-1437-45bc-9B07-AD6F015E5F28 displayName=Phone and Mail Options localizationDisplayId=22 rightsGUID=E45795B2-9455-11d1-AEBD-0000F80367C1 validAccesses=0x30 [Personal-Information] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967aba-0de6-11d0-a285-00aa003049e2 appliesTo=5cb41ed0-0e4c-11d0-a286-00aa003049e2 appliesTo=bf967a86-0de6-11d0-a285-00aa003049e2 appliesTo=4828CC14-1437-45bc-9B07-AD6F015E5F28 displayName=Personal Information localizationDisplayId=23 rightsGUID=77B5B886-944A-11d1-AEBD-0000F80367C1 validAccesses=0x30 [Web-Information] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967aba-0de6-11d0-a285-00aa003049e2 appliesTo=5cb41ed0-0e4c-11d0-a286-00aa003049e2 appliesTo=4828CC14-1437-45bc-9B07-AD6F015E5F28 displayName=Web Information localizationDisplayId=24 rightsGUID=E45795B3-9455-11d1-AEBD-0000F80367C1 validAccesses=0x30 [DS-Replication-Get-Changes] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=19195a5b-6da0-11d0-afd3-00c04fd930c9 appliesTo=bf967a87-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a8f-0de6-11d0-a285-00aa003049e2 displayName=Replicating Directory Changes localizationDisplayId=25 rightsGUID=1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 validAccesses=0x100 [DS-Replication-Synchronize] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=19195a5b-6da0-11d0-afd3-00c04fd930c9 appliesTo=bf967a87-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a8f-0de6-11d0-a285-00aa003049e2 displayName=Replication Synchronization localizationDisplayId=26 rightsGUID=1131f6ab-9c07-11d1-f79f-00c04fc2dcd2 validAccesses=0x100 [DS-Replication-Manage-Topology] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=19195a5b-6da0-11d0-afd3-00c04fd930c9 appliesTo=bf967a87-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a8f-0de6-11d0-a285-00aa003049e2 displayName=Manage Replication Topology localizationDisplayId=27 rightsGUID=1131f6ac-9c07-11d1-f79f-00c04fc2dcd2 validAccesses=0x100 [User-Change-Password] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967aba-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a86-0de6-11d0-a285-00aa003049e2 appliesTo=4828CC14-1437-45bc-9B07-AD6F015E5F28 displayName=Change Password localizationDisplayId=2 rightsGUID=ab721a53-1e2f-11d0-9819-00aa0040529b validAccesses=0x100 [User-Force-Change-Password] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967aba-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a86-0de6-11d0-a285-00aa003049e2 appliesTo=4828CC14-1437-45bc-9B07-AD6F015E5F28 displayName=Reset Password localizationDisplayId=3 rightsGUID=00299570-246d-11d0-a768-00aa006e0529 validAccesses=0x100 [Unexpire-Password] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=19195a5b-6da0-11d0-afd3-00c04fd930c9 displayName=Unexpire Password localizationDisplayId=69 rightsGUID=ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501 validAccesses=0x100 [Self-Membership] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967a9c-0de6-11d0-a285-00aa003049e2 displayName=Add/Remove self as member localizationDisplayId=12 rightsGUID=bf9679c0-0de6-11d0-a285-00aa003049e2 validAccesses=0x8 [Change-Schema-Master] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967a8f-0de6-11d0-a285-00aa003049e2 displayName=Change Schema Master localizationDisplayId=28 rightsGUID=e12b56b6-0a95-11d1-adbb-00c04fd8d5cd validAccesses=0x100 [Do-Garbage-Collection] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=f0f8ffab-1191-11d0-a060-00aa006c33ed displayName=Do Garbage Collection localizationDisplayId=31 rightsGUID=fec364e0-0a98-11d1-adbb-00c04fd8d5cd validAccesses=0x100 [Add-GUID] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=19195a5b-6da0-11d0-afd3-00c04fd930c9 displayName=Add GUID localizationDisplayId=35 rightsGUID=440820ad-65b4-11d1-a3da-0000f875ae0d validAccesses=0x100 [Change-Naming-Master] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=ef9e60e0-56f7-11d1-a9c6-0000f80367c1 displayName=Change Naming Master localizationDisplayId=36 rightsGUID=014bf69c-7b3b-11d1-85f6-08002be74fab validAccesses=0x100 [Public-Information] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967aba-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a86-0de6-11d0-a285-00aa003049e2 appliesTo=4828CC14-1437-45bc-9B07-AD6F015E5F28 displayName=Public Information localizationDisplayId=37 rightsGUID=e48d0154-bcf8-11d1-8702-00c04fb96050 validAccesses=0x30 [DS-Install-Replica] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=19195a5b-6da0-11d0-afd3-00c04fd930c9 displayName=Add/Remove Replica In Domain localizationDisplayId=49 rightsGUID=9923a32a-3607-11d2-b9be-0000f87a36b2 validAccesses=0x100 [Update-Schema-Cache] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=bf967a8f-0de6-11d0-a285-00aa003049e2 displayName=Update Schema Cache localizationDisplayId=51 rightsGUID=be2bb760-7f46-11d2-b9ad-00c04f79f805 validAccesses=0x100 [Recalculate-Security-Inheritance] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ValidAccesses=0x100 ShowInAdvancedViewOnly=True appliesTo=f0f8ffab-1191-11d0-a060-00aa006c33ed displayName=Recalculate Security Inheritance localizationDisplayId=52 rightsGUID=62dd28a8-7f46-11d2-b9ad-00c04f79f805 [DS-Replication-Get-Changes-All] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=19195a5b-6da0-11d0-afd3-00c04fd930c9 appliesTo=bf967a87-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a8f-0de6-11d0-a285-00aa003049e2 displayName=Replicating Directory Changes All localizationDisplayId=62 rightsGUID=1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 validAccesses=0x100 [Reanimate-Tombstones] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=19195a5b-6da0-11d0-afd3-00c04fd930c9 appliesTo=bf967a87-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a8f-0de6-11d0-a285-00aa003049e2 displayName=Reanimate Tombstones localizationDisplayId=64 rightsGUID=45EC5156-DB7E-47bb-B53F-DBEB2D03C40F validAccesses=0x100 [DS-Execute-Intentions-Script] nTSecurityDescriptor=O:EAG:EAD: objectClass = controlAccessRight ObjectCategory = Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=ef9e60e0-56f7-11d1-a9c6-0000f80367c1 displayName=Execute Directory Update Script localizationDisplayId=66 rightsGUID=2f16c4a5-b98e-432c-952a-cb388ba33f2e validAccesses=0x100 [DS-Replication-Monitor-Topology] nTSecurityDescriptor=O:EAG:EAD: objectClass=controlAccessRight ObjectCategory=Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=19195a5b-6da0-11d0-afd3-00c04fd930c9 appliesTo=bf967a87-0de6-11d0-a285-00aa003049e2 appliesTo=bf967a8f-0de6-11d0-a285-00aa003049e2 displayName=Monitor Active Directory Replication localizationDisplayId=67 rightsGUID=f98340fb-7c5b-4cdb-a00b-2ebdfa115a96 validAccesses=0x100 [DS-Query-Self-Quota] nTSecurityDescriptor=O:EAG:EAD: objectClass=controlAccessRight ObjectCategory=Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=da83fc4f-076f-4aea-b4dc-8f4dab9b5993 displayName=Query Self Quota localizationDisplayId=71 rightsGUID=4ecc03fe-ffc0-4947-b630-eb672a8a9dbc validAccesses=0x100 [Reload-SSL-Certificate] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;AU)(A;;RPWPCRLCLOCCDCRCWDWOSW;;;EA)(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY) objectClass=controlAccessRight ObjectCategory=Control-Access-Right ShowInAdvancedViewOnly=True appliesTo=f0f8ffab-1191-11d0-a060-00aa006c33ed displayName=Reload SSL/TLS Certificate localizationDisplayId=76 rightsGUID=1a60ea8d-58a6-4b20-bcdc-fb71eb8a9ff8 validAccesses=0x100 ;-------------------------------------------------------- ; store information for DirectoryUpdates ;-------------------------------------------------------- [DirectoryUpdates] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA)S:(AU;CISA;CCDCSDDT;;;WD) objectClass=Container ObjectCategory=Container ;systemFlags=FLAG_DISALLOW_DELETE systemFlags=0x80000000 CHILD=94fdebc6-8eeb-4640-80de-ec52b9ca17fa ;!-------------------------------------------------------- ;! Created Forest ;! This operations guid 94fdebc6-8eeb-4640-80de-ec52b9ca17fa is set on forests where the ;! first DC in the forest had at least a Windows server 2003 ;! code base, schema, etc. The objectVersion for W2k3 is not set, thereafter, it's ;! kept identical to the msds-behavior-version of the first dc in the enterprise. ;! ;! In ADAM, this object doesn't exist for V1, but the longhorn version forward will ;! also follow this standard (meaning in LH, the object exists and objectVersion=3 ;!-------------------------------------------------------- [94fdebc6-8eeb-4640-80de-ec52b9ca17fa] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;WD)(A;;RPWPCRLCLOCCRCWDWOSW;;;EA)(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY) objectClass=Container ObjectCategory=Container objectVersion = 4 [NTDS Quotas config] RDN-Of-Object=NTDS Quotas nTSecurityDescriptor=O:EAG:EAD:P(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)(OA;;CR;4ecc03fe-ffc0-4947-b630-eb672a8a9dbc;;WD)S:(AU;CISA;WDWOSDDTWPCRCCDCSW;;;WD) objectClass=msDS-QuotaContainer objectCategory=ms-DS-Quota-Container description=Quota specifications container ShowInAdvancedViewOnly=True isCriticalSystemObject=True ;systemFlags=FLAG_DISALLOW_DELETE systemFlags=0x80000000 msDS-TombstoneQuotaFactor=100 [ForeignSecurityPrincipals] nTSecurityDescriptor=O:EAG:EAD:(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)(A;CI;RPLCLORC;;;DG) objectClass =Container ObjectCategory =Container description=Default container for security identifiers (SIDs) associated with objects from external, trusted domains ShowInAdvancedViewOnly=False isCriticalSystemObject=True ;systemFlags=FLAG_DISALLOW_DELETE systemFlags=0x80000000 [Roles] nTSecurityDescriptor=O:EAG:EAD:(A;CI;RPLCLORC;;;DG)(A;CI;RPWPCRLCLOCCRCWDWOSW;;;EA) objectClass=Container objectCategory=Container ShowInAdvancedViewOnly=False ;systemFlags=FLAG_DISALLOW_DELETE systemFlags=0x80000000 CHILD=Administrators CHILD=Readers CHILD=Users CHILD=Instances [Administrators] nTSecurityDescriptor=O:EAG:EAD: objectClass=group objectCategory=group ;systemFlags=FLAG_DISALLOW_DELETE systemFlags=0x80000000 objectSid=EA member=<SID=$REGISTRY=Admin SID$> [Users] nTSecurityDescriptor=O:EAG:EAD: objectClass=group objectCategory=group ;systemFlags=FLAG_DISALLOW_DELETE systemFlags=0x80000000 objectSid=DU [Readers] nTSecurityDescriptor=O:EAG:EAD: objectClass=group objectCategory=group ;systemFlags=FLAG_DISALLOW_DELETE systemFlags=0x80000000 objectSid=DG ; member=$EMBEDDED:CN=Users,CN=Roles,<Configuration NC ; auth users ; member=<SID=S-1-5-11> [Instances] nTSecurityDescriptor=O:EAG:EAD: objectClass=group objectCategory=group ;systemFlags=FLAG_DISALLOW_DELETE systemFlags=0x80000000 objectSid=SA member=<SID=$REGISTRY=Service SID$> member=<SID=$REGISTRY_OPTIONAL=Machine SID$> ;!-------------------------------------------------------- ;! Schema naming context object ;!-------------------------------------------------------- [SCHEMA] objectClass = DMD objectCategory = DMD objectVersion = 30 nTSecurityDescriptor=O:EAG:EAD:(A;CI;RPLCLORC;;;AU)(A;CI;RPWPCRLCLOCCRCWDWOSW;;;EA)(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;SA)(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;SA)(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;SA)(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;SA)(A;;LCRPLORC;;;SA)S:(AU;SA;WDWOWPCCDCSDDTSWCR;;;WD)(AU;CISA;WP;;;WD) ;Its a NC ROOT - (NC_MASTER_SUBREF) instanceType=13 fSMORoleOwner=$REGISTRY=Machine DN Name ;!-------------------------------------------------------- ;! Templates used for new server objects. ;!-------------------------------------------------------- ;-------------------------------------------------------- ; This template works for all new servers, first in enterprise or replica. ; This section is not used if the server already exists, as might be the case ; if the server was indeed a server (i.e. not a DC) and registered in the DS ; already. ;-------------------------------------------------------- [DEFAULTANYSERVER] nTSecurityDescriptor=O:EAG:EAD:(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)(A;;RPLCLORC;;;DG)(A;;RPWPLCLORCDTDC;;;SA) objectClass=Server ObjectCategory=Server dnsHostname=$REGISTRY=Network Name nETBIOSName=$REGISTRY=Netbios Name ;systemFlags=FLAG_CONFIG_ALLOW_RENAME | ; FLAG_CONFIG_ALLOW_LIMITED_MOVE | ; FLAG_DISALLOW_MOVE_ON_DELETE systemFlags=0x52000000 ;-------------------------------------------------------- ; Template for NTDS-DSA object for the first DS DC in the enterprise. ; This machine is not a Global Catalog. ;-------------------------------------------------------- [DEFAULTFIRSTMACHINE] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSDDTSW;;;EA)(A;;RPWPLCLORCDTDC;;;SA) objectClass=NTDSDSA ObjectCategory=NTDS-DSA invocationID=\x00000000000000000000000000000000 hasMasterNCs= $REGISTRY=Configuration NC hasMasterNCs= $REGISTRY=Schema DN Name msDS-hasMasterNCs= $REGISTRY=Configuration NC msDS-hasMasterNCs= $REGISTRY=Schema DN Name dMDLocation= $REGISTRY=Schema DN Name msDS-portLDAP= $REGISTRY=Port LDAP msDS-portSSL= $REGISTRY=Port SSL Options=0 ; // Not a GC! ;if you change this behavior version, please change the objectVersion ;on object 94fdebc6-8eeb-4640-80de-ec52b9ca17fa to match. it holds the ;version of the first instance in the enterprise, even after such ;instance is gone. msDs-Behavior-Version=4 ;systemFlags=FLAG_DISALLOW_MOVE_ON_DELETE systemFlags=0x02000000 msDS-ServiceAccount=<SID=$REGISTRY=Service SID$> msDS-ServiceAccount=<SID=$REGISTRY_OPTIONAL=Machine SID$> ;-------------------------------------------------------- ; Template for NTDS-DSA object for DS DCs joined to a pre-existing enterprise. ; This machine is by default NOT a Global Catalog. ;-------------------------------------------------------- [DEFAULTADDLMACHINE] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSDDTSW;;;EA)(A;;RPWPLCLORCDTDC;;;SA) objectClass=NTDSDSA objectCategory=NTDS-DSA invocationID=\x00000000000000000000000000000000 hasMasterNCs= $REGISTRY=Configuration NC hasMasterNCs= $REGISTRY=Schema DN Name msDS-hasMasterNCs= $REGISTRY=Configuration NC msDS-hasMasterNCs= $REGISTRY=Schema DN Name dMDLocation= $REGISTRY=Schema DN Name msDS-portLDAP= $REGISTRY=Port LDAP msDS-portSSL= $REGISTRY=Port SSL msDs-Behavior-Version=4 ;systemFlags=FLAG_DISALLOW_MOVE_ON_DELETE systemFlags=0x02000000 msDS-ServiceAccount=<SID=$REGISTRY=Service SID$> msDS-ServiceAccount=<SID=$REGISTRY_OPTIONAL=Machine SID$> ;-------------------------------------------------------- ; Template for NTDS-DSA object for DS DCs joined to an existing domain. ; This machine is by default NOT a Global Catalog. ;-------------------------------------------------------- [DEFAULTADDLMACHINEREPLICA] nTSecurityDescriptor=O:EAG:EAD:(A;;RPLCLORC;;;DG)(A;;RPWPCRLCLOCCRCWDWOSDDTSW;;;EA)(A;;RPWPLCLORCDTDC;;;SA) objectClass=NTDSDSA objectCategory=NTDS-DSA invocationID=\x00000000000000000000000000000000 hasMasterNCs= $REGISTRY=Configuration NC hasMasterNCs= $REGISTRY=Schema DN Name msDS-hasMasterNCs= $REGISTRY=Configuration NC msDS-hasMasterNCs= $REGISTRY=Schema DN Name dMDLocation= $REGISTRY=Schema DN Name msDS-portLDAP= $REGISTRY=Port LDAP msDS-portSSL= $REGISTRY=Port SSL msDs-Behavior-Version=4 ;systemFlags=FLAG_DISALLOW_MOVE_ON_DELETE systemFlags=0x02000000 msDS-ServiceAccount=<SID=$REGISTRY=Service SID$> msDS-ServiceAccount=<SID=$REGISTRY_OPTIONAL=Machine SID$> ;-------------------------------------------------------- ; The following NTDS-Connection objects are added only in the course of ; replicated installs. ;-------------------------------------------------------- [DEFAULTLOCALCONNECTION] nTSecurityDescriptor=O:EAG:EAD:(A;;RPWPCRLCLOCCRCWDWOSDDTSW;;;EA)(A;;RPLCLORC;;;DG) objectClass=NTDSConnection objectCategory=NTDS-Connection enabledConnection=1 fromServer=$REGISTRY=Remote Machine DN Name Options=1 Schedule=$SYSDEFAULT=REPLSCHEDULE ;systemFlags=FLAG_CONFIG_ALLOW_MOVE systemFlags=0x20000000 [DEFAULTREMOTECONNECTION] nTSecurityDescriptor=O:EAG:EAD:(A;;RPWPCRLCLOCCRCWDWOSDDTSW;;;EA)(A;;RPLCLORC;;;DG) objectClass=NTDSConnection ObjectCategory=NTDS-Connection enabledConnection=1 fromServer=$REGISTRY=Machine DN Name Options=1 Schedule=$SYSDEFAULT=REPLSCHEDULE ;systemFlags=FLAG_CONFIG_ALLOW_MOVE systemFlags=0x20000000