Export (0) Print
Expand All
This topic has not yet been rated - Rate this topic

Implement ACEs for the Customer Organization

The access control entries (ACEs) specified for each customer organizational unit (OU) control the type of access to this organization that each group is granted. ACEs on all customer groups allow them to access their parent object - the reseller organization - but restrict access to the reseller organization. ACEs on the customer organization grant different permissions to different groups within the customer organization. The Remove Authenticated Users ACE is set on each customer OU to prevent all user accounts from reading the contents of the customer OU, unless they are explicitly granted this right.

ACEs for the AllUsers@customer Group

The ACEs on the AllUsers@customer group grant List Object permissions for the customer OU to user objects.

The following table describes the ACE for the AllUsers@customer group that controls this group's access to the customer OU. This ACE grants all members of this group List Object permissions to the customer OU and applies only to the customer OU.

Table: List Object ACEs for the AllUsers@customer Group

Allowed or denied to Permission Apply to

AllUsers@customer

Special

This object only

Permission

Allow

-

List Object

ADS_RIGHT_DS_LIST_OBJECT

-

The following table describes the ACEs for the AllUsers@customer group that govern permissions to the customer organization by users. These ACEs are applied to this group and any of its child objects. They grant List Object and Read permissions to all members of this group.

Table: ACEs for the AllUsers@customer Group

Allowed or denied to Permission Apply to

AllUsers@customer

Special

This object and all child objects

Permission

Allow

-

List Contents

ADS_RIGHT_DS_ACTRL_DS_LIST

-

Read All Properties

ADS_RIGHT_DS_READ_PROP

-

Read permissions

ADS_RIGHT_READ_CONTROL

-

User ACEs for the Admins@customer Group

The following tables describe ACEs that govern access to user objects and any of their child objects by organization administrators. These ACEs specify permissions that members of the Admins@customer group have for user objects.

The following table describes the permissions that allow members of the Admins@customer group to create and delete user objects within the customer organization.

Table: User ACEs for the Admins@customer Group

Allowed or denied to Permission Apply to

Admins@customer

Special

This object and all child objects

Permission

Allow

-

Create user objects

ADS_RIGHT_DS_CREATE_CHILD

-

Delete user objects

ADS_RIGHT_DS_DELETE_CHILD

-

The following table describes an ACE that governs access to user objects. This ACE allows organization administrators full control over user objects.

Table: All Items User ACEs for the Admins@customer Group

Allowed or denied to Permission Apply to

Admins@customer

Full control

User object

Permission

Allow

-

All items

ADS_RIGHT_GENERIC_ALL

-

Group ACEs for Admins@customer Group

The following tables describe the ACEs that give members of the Admins@customer group permissions on group objects within their organization. The Admins@customer ACE allows customer organization administrators to create and delete groups within their organization.

The following table describes the group ACEs.

Table: Group ACEs for Admins@customer Group

Allowed or denied to Permission Apply to

Admins@customer

Create/delete group objects

This object and all child objects

Permission

Allow

-

Create group object

ADS_RIGHT_DS_CREATE_CHILD

-

Delete group object

ADS_RIGHT_DS_DELETE_CHILD

-

The following table describes the All Items group ACEs.

Table: All Items Group ACEs for Admins@customer Group

Allowed or denied to Permission Apply to

Admins@Customer

Full Control

Group object

Permission

Allow

-

All items

ADS_RIGHT_DS_GENERIC_ALL

-

OU ACEs for the Admins@customer Group

The following table describes the OU ACEs.

Table: OU ACEs for the Admins@customer Group

Allowed or denied to Permission Apply to

Admins@customer

Create/delete group OU objects

This object and all child objects

Permission

Allow

-

Create OU

ADS_RIGHT_DS_CREATE_CHILD

-

Delete group object

ADS_RIGHT_DS_DELETE_CHILD

-

The ACE described in the following table allows members of the Admins@customer group full control over other OUs within their customer OU.

Table: All Items OU ACEs for the Admins@customer Group

Allowed or denied to Permission Apply to

Admins@customer

Full Control

Group object

Permission

Allow

-

All items

ADS_RIGHT_DS_GENERIC_ALL

-

User ACEs for the CSRAdmins@customer Group

The following tables contain ACEs that govern access to user objects and any of their child objects by the organization's CSRs. These ACEs specify permissions that members of the CSRAdmins@customer group have for user objects.

The following table describes the permissions that allow organization CSRs to create and delete user objects within the customer OU.

Table: User ACEs for the CSRAdmins@customer Group

Allowed or denied to Permission Apply to

CSRAdmins@customer

Create/delete user objects

This object and all child objects

Permission

Allow

-

Create user objects

ADS_RIGHT_DS_CREATE_CHILD

-

Delete user objects

ADS_RIGHT_DS_DELETE_CHILD

-

The following table describes an ACE that governs access to user objects by organization CSRs. This ACE gives members of the CSRAdmins@customer group full control over user objects.

Table: All Items User ACEs for the CSRAdmins@customer Group

Allowed or denied to Permission Apply to

CSRAdmins@customer

Full control

User object

Permission

Allow

-

All items

ADS_RIGHT_GENERIC_ALL

-

Group ACEs for the CSRAdmins@customer Group

The following tables describe the ACEs that give members of the CSRAdmins@customer group permissions on group objects within their OU.

The ACE in the following table enables organization CSRs to create and delete groups within their OU.

Table: Group ACEs for the CSRAdmins@customer Group

Allowed or denied to Permission Apply to

CSRAdmins@customer

Create/delete group objects

This object and all child objects

Permission

Allow

-

Create group object

ADS_RIGHT_DS_CREATE_CHILD

-

Delete group object

ADS_RIGHT_DS_DELETE_CHILD

-

The following table describes an ACE that gives organization CSRs full control over group objects within their OUs.

Table: All Items Group ACEs for the CSRAdmins@customer Group

Allowed or denied to Permission Apply to

CSRAdmins@customer

Full Control

Group object

Permission

Allow

-

All items

ADS_RIGHT_DS_GENERIC_ALL

-

OU ACEs for the CSRAdmins@customer Group

The following tables represent the ACEs that govern access for members of the CSRAdmins@customer group to OU objects within the customer organization.

The ACE in the following table enables organization CSRs to create and delete child OUs within their customer OU.

Table: OU ACEs for the CSRAdmins@customer Group

Allowed or denied to Permission Apply to

CSRAdmins@customer

Create/delete group OU objects

This object and all child objects

Permission

Allow

-

Create OU object

ADS_RIGHT_DS_CREATE_CHILD

-

Delete OU object

ADS_RIGHT_DS_DELETE_CHILD

-

The following table describes an ACE that gives organization CSRs full control over OUs within their customer OU.

Table: All Items OU ACEs for the CSRAdmins@customer Group

Allowed or denied to Permission Apply to

CSRAdmins@customer

Full Control

Group object

Permission

Allow

-

All items

ADS_RIGHT_DS_GENERIC_ALL

-

ACE for Child OUs

The Remove Authenticated Users ACE is set on each child organization to prevent all users from reading the contents of the child organization, unless they are explicitly granted this right.

ACE for the _private Container

The _private container contains special containers and groups required to implement Delegated Administration Console functionality. It contains the Remove Authenticated Users ACE to prevent all users from accessing the _private container except those explicitly authorized to do so.

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.