Export (0) Print
Expand All

Appendix D: Active Directory Extended Rights

Updated: December 5, 2005

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

This appendix contains all of the extended rights defined in the Windows 2000 Server and Windows Server 2003 Active Directory schemas. The following table defines the terms used in the tables that describe these rights.

 

Item Description

CN (Common Name)

Every object in the DS has a naming attribute from which its relative distinguished name is formed. The naming attribute for control-Access-Right objects is Common-Name.

Display-Name

The Common-Name of an object might not be descriptive enough for some users; Display-Name provides a more descriptive name.

Rights-GUID

The unique ID for identifying a control access right.

Applies-to

A list of GUIDs that represent the objects to which this property set applies. For example, e5209ca2-3bba-11d2-90cc-00c04fd91ab1 refers to PKI-Certificate-Template objects.

Extended Rights Defined in the Windows 2000 Active Directory Schema

The tables in this section contain extended rights defined in the Windows 2000 Active Directory schema.

Abandon-Replication*

 

Item Description

Description

Extended right needed to cancel a replication sync.

CN

Abandon-Replication

Display-Name

Abandon Replication

Rights-GUID

ee914b82-0a98-11d1-adbb-00c04fd8d5cd

Applies-To

NTDS-DSA

* This right is not used.

Add-GUID

 

Item Description

Description

Extended right needed at the NC root to add an object with a specific GUID.

CN

Add-GUID

Display-Name

Add GUID

Rights-GUID

440820ad-65b4-11d1-a3da-0000f875ae0d

Applies-To

Domain-DNS

Allocate-RIDs

 

Item Description

Description

Extended right needed to request a pool of RIDs.

CN

Allocate-RIDs

Display-Name

Allocate RIDs

Rights-GUID

1abd7cf8-0a99-11d1-adbb-00c04fd8d5cd

Applies-To

NTDS-DSA

Apply-Group-Policy

 

Item Description

Description

Extended right used by Group Policy engine to determine whether a GPO applies to a particular user or computer.

CN

Apply-Group-Policy

Display-Name

Apply Group Policy

Rights-GUID

edacfd8f-ffb3-11d1-b41d-00a0c968f939

Applies-To

Group-Policy-Container

Certificate-Enrollment

 

Item Description

Description

Extended right needed to cause certificate enrollment.

CN

Certificate-Enrollment

Display-Name

Check Stale Phantoms

Rights-GUID

69ae6200-7f46-11d2-b9ad-00c04f79f805

Applies-To

PKI-Certificate-Template

Change-Domain-Master

 

Item Description

Description

Extended right needed to change the Domain Master role owner.

CN

Change-Domain-Master

Display-Name

Change Domain Master

Rights-GUID

014bf69c-7b3b-11d1-85f6-08002be74fab

Applies-To

Cross-Ref-Container

Change-Infrastructure-Master

 

Item Description

Description

Extended right needed to change the Infrastructure FSMO role owner.

CN

Change-Infrastructure-Master

Display-Name

Change Infrastructure Master

Rights-GUID

cc17b1fb-33d9-11d2-97d4-00c04fd8d5cd

Applies-To

Infrastructure-Update

Change-PDC

 

Item Description

Description

Extended right needed to change the PDC Emulator role owner.

CN

Change-PDC

Display-Name

Change PDC

Rights-GUID

bae50096-4752-11d1-9052-00c04fc2d4cf

Applies-To

Domain-DNS

Change-RID-Master

 

Item Description

Description

Extended right needed to change the RID-Master role owner.

CN

Change-RID-Master

Display-Name

Change RID Master

Rights-GUID

d58d5f36-0a98-11d1-adbb-00c04fd8d5cd

Applies-To

RID-Manager

Change-Schema-Master

 

Item Description

Description

Extended right needed to change the Schema Master FSMO role owner.

CN

Change-Schema-Master

Display-Name

Change Schema Master

Rights-GUID

e12b56b6-0a95-11d1-adbb-00c04fd8d5cd

Applies-To

DMD

Do-Garbage-Collection

 

Item Description

Description

Extended right to force the directory service to do garbage collection.

CN

Do-Garbage-Collection

Display-Name

Do Garbage Collection

Rights-GUID

fec364e0-0a98-11d1-adbb-00c04fd8d5cd

Applies-To

NTDS-DSA

Domain-Administer-Server

 

Item Description

Description

Legacy SAM right.

CN

Domain-Administer-Server

Display-Name

Domain Administer Server

Rights-GUID

ab721a52-1e2f-11d0-9819-00aa0040529b

Applies-To

Sam-Server

DS-Check-Stale-Phantoms

 

Item Description

Description

Extended right needed to force the directory service to check stale phantom objects.

CN

DS-Check-Stale-Phantoms

Display-Name

Check Stale Phantoms

Rights-GUID

69ae6200-7f46-11d2-b9ad-00c04f79f805

Applies-To

NTDS-DSA

DS-Install-Replica

 

Item Description

Description

Extended right needed to do a replica install.

CN

DS-Install-Replica

Display-Name

Add/Remove Replica In Domain

Rights-GUID

9923a32a-3607-11d2-b9be-0000f87a36b2

Applies-To

Domain-DNS

DS-Replication-Get-Changes

 

Item Description

Description

Extended right needed to replicate changes from a given NC.

noteNote
This extended right was modified in Windows Server 2003 – refer to the Windows Server 2003 Active Directory Schema Extended Rights section for details on how this right works in Windows Server 2003.

CN

DS-Replication-Get-Changes

Display-Name

Replicating Directory Changes

Rights-GUID

1131f6aa-9c07-11d1-f79f-00c04fc2dcd2

Applies-To

Configuration

DMD

Domain-DNS

DS-Replication-Manage-Topology

 

Item Description

Description

Extended right needed to update the replication topology for a given NC.

CN

DS-Replication-Manage-Topology

Display-Name

Manage Replication Topology

Rights-GUID

1131f6ac-9c07-11d1-f79f-00c04fc2dcd2

Applies-To

Configuration

DMD

Domain-DNS

DS-Replication-Synchronize

 

Item Description

Description

Extended right needed to synchronize replication from a given NC.

CN

DS-Replication-Synchronize

Display-Name

Replication Synchronization

Rights-GUID

1131f6ab-9c07-11d1-f79f-00c04fc2dcd2

Applies-To

Configuration

DMD

Domain-DNS

msmq-Open-Connector

 

Item Description

Description

Allows opening the connector queue.

CN

msmq-Open-Connector

Display-Name

Open Connector Queue

Rights-GUID

b4e60130-df3f-11d1-9c86-006008764d0e

Applies-To

Site

msmq-Peek

 

Item Description

Description

Allows peeking at messages in the queue.

CN

msmq-Peek

Display-Name

Peek Message

Rights-GUID

06bd3201-df3e-11d1-9c86-006008764d0e

Applies-To

MSMQ-Queue

msmq-Peek-computer-Journal

 

Item Description

Description

Allows peeking at messages in the Computer Journal queue.

CN

Msmq-Peek-computer-Journal

Display-Name

Peek Computer Journal

Rights-GUID

4b6e08c3-df3c-11d1-9c86-006008764d0e

Applies-To

MSMQ-Configuration

msmq-Peek-Dead-Letter

 

Item Description

Description

Allows peeking at messages in the Dead Letter queue.

CN

Msmq-Peek-Dead-Letter

Display-Name

Peek Dead Letter

Rights-GUID

4b6e08c1-df3c-11d1-9c86-006008764d0e

Applies-To

MSMQ-Configuration

msmq-Receive

 

Item Description

Description

Allows receiving messages from the queue.

CN

msmq-Receive

Display-Name

Receive Message

Rights-GUID

06bd3200-df3e-11d1-9c86-006008764d0e

Applies-To

MSMQ-Queue

msmq-Receive-computer-Journal

 

Item Description

Description

Allows receiving messages from the Computer Journal queue.

CN

Msmq-Receive-computer-Journal

Display-Name

Receive Computer Journal

Rights-GUID

4b6e08c2-df3c-11d1-9c86-006008764d0e

Applies-To

MSMQ-Configuration

msmq-Receive-Dead-Letter

 

Item Description

Description

Allows receiving messages from the Dead Letter queue.

CN

Msmq-Receive-Dead-Letter

Display-Name

Receive Dead Letter

Rights-GUID

4b6e08c0-df3c-11d1-9c86-006008764d0e

Applies-To

MSMQ-Configuration

msmq-Receive-journal

 

Item Description

Description

Allows receiving messages from the queue’s Journal.

CN

msmq-Receive-journal

Display-Name

Receive Journal

Rights-GUID

06bd3203-df3e-11d1-9c86-006008764d0e

Applies-To

MSMQ-Queue

msmq-Send

 

Item Description

Description

Allows sending messages to the queue.

CN

msmq-Send

Display-Name

Send Message

Rights-GUID

06bd3202-df3e-11d1-9c86-006008764d0e

Applies-To

MSMQ-Queue

Open-Address-Book

 

Item Description

Description

Extended right checked when opening address book object for address book views.

CN

Open-Address-Book

Display-Name

Open Address List

Rights-GUID

a1990816-4298-11d1-ade2-00c04fd8d5cd

Applies-To

Address-Book-Container

Recalculate-Hierarchy

 

Item Description

Description

Extended right to force the DS to recalculate the hierarchy.

CN

Recalculate-Hierarchy

Display-Name

Recalculate Hierarchy

Rights-GUID

0bc1554e-0a99-11d1-adbb-00c04fd8d5cd

Applies-To

NTDS-DSA

Recalculate-Security-Inheritance

 

Item Description

Description

Extended right needed to force DS to recompute ACL inheritance on a naming context.

CN

Recalculate-Security-Inheritance

Display-Name

Recalculate Security Inheritance

Rights-GUID

62dd28a8-7f46-11d2-b9ad-00c04f79f805

Applies-To

NTDS-DSA

Receive-As

 

Item Description

Description

Exchange right: allows receiving mail as a given mailbox.

CN

Receive-As

Display-Name

Receive As

Rights-GUID

ab721a56-1e2f-11d0-9819-00aa0040529b

Applies-To

Computer

User

Send-As

 

Item Description

Description

Exchange right: allows sending mail as the mailbox.

CN

Send-As

Display-Name

Send As

Rights-GUID

ab721a54-1e2f-11d0-9819-00aa0040529b

Applies-To

Computer

User

Send-To

 

Item Description

Description

Exchange right: allows sending to a mailbox.

CN

Send-To

Display-Name

Send To

Rights-GUID

ab721a55-1e2f-11d0-9819-00aa0040529b

Applies-To

Group

Update-Schema-Cache

 

Item Description

Description

Extended right to force a schema cache update.

CN

Update-Schema-Cache

Display-Name

Update Schema Cache

Rights-GUID

be2bb760-7f46-11d2-b9ad-00c04f79f805

Applies-To

DMD

User-Change-Password

 

Item Description

Description

Permits changing password on user account.

CN

User-Change-Password

Display-Name

Change Password

Rights-GUID

ab721a53-1e2f-11d0-9819-00aa0040529b

Applies-To

Computer

User

User-Force-Change-Password

 

Item Description

Description

Permits resetting password on user account.

CN

User-Force-Change-Password

Display-Name

Reset Password

Rights-GUID

00299570-246d-11d0-a768-00aa006e0529

Applies-To

Computer

User

Windows Server 2003 Active Directory Schema Extended Rights

Allowed-To-Authenticate

 

Item Description

Description

This extended right controls who can authenticate to a particular machine or service. It is applied on computer, user and InetOrgPerson objects. It is also applicable on the domain object if access is allowed for the entire domain. It can be applied to OUs to permit users to be able to set inheritable ACEs on OUs containing a set of user/computer objects.

CN

Allowed-To-Authenticate

Display-Name

Allowed to Authenticate

Rights-GUID

68B1D179-0D15-4d4f-AB71-46152E79A7BC

Applies-To

Computer

inetOrgPerson

User

Create-Inbound-Forest-Trust

 

Item Description

Description

Extended right that enables users to create an inbound-only trust between forests by adding them to the appropriate group.

CN

Create-Inbound-Forest-Trust

Display-Name

Create Inbound Forest Trust

Rights-GUID

e2a36dc9-ae17-47c3-b58b-be34c55ba633

Applies-To

Domain-DNS

DS-Execute-Intentions-Script

 

Item Description

Description

Extended right, which should be granted to the partitions container, that allows the Rendom.exe or prepare operation to be used in a domain rename. This control access right also appears as an audit-only right when the Redom.exe or execute step operations are performed.

CN

DS-Execute-Intentions-Script

Display-Name

Execute Forest Update Script

Rights-GUID

2f16c4a5-b98e-432c-952a-cb388ba33f2e

Applies-To

Cross-Ref-Container

DS-Query-Self-Quota

 

Item Description

Description

Control access right which allows a user to query the user’s own quotas.

CN

DS-Query-Self-Quota

Display-Name

Query Self Quota

Rights-GUID

4ecc03fe-ffc0-4947-b630-eb672a8a9dbc

Applies-To

ms-DS-Quota-Container

DS-Replication-Get-Changes

 

Item Description

Description

Extended right needed to replicate only those changes from a given NC that are also replicated to the Global Catalog (which excludes secret domain data). This constraint is only meaningful for Domain NCs.

noteNote
In Windows 2000, this extended right allowed the replication of all data including secret data. In Windows Server 2003, this right does not allow the replication of secret data. To replicate all data including secret data, the DS-Replication-Get-Changes-All extended right is required (this new extended right was introduced in Windows Server 2003).

CN

DS-Replication-Get-Changes

Display-Name

Replicating Directory Changes

Rights-GUID

1131f6aa-9c07-11d1-f79f-00c04fc2dcd2

Applies-To

Configuration

DMD

Domain-DNS

DS-Replication-Get-Changes-All

 

Item Description

Description

Control access right that allows the replication of all data in a given replication NC, including secret domain data.

noteNote
In Windows Server 2003, the Get Replication Changes Extended right has been modified such that it only allows the replication of all data in a given replication NC that is also replicated to the Global Catalog (which excludes secret domain data).

CN

DS-Replication-Get-Changes-All

Display-Name

Replicating Directory Changes All

Rights-GUID

1131f6ad-9c07-11d1-f79f-00c04fc2dcd2

Applies-To

Configuration

DMD

Domain-DNS

DS-Replication-Monitor-Topology

 

Item Description

Description

Extended control access right that allows the reading of replication monitoring data, such as replication status and object metadata.

CN

DS-Replication-Monitor-Topology

Display-Name

Monitor Active Directory Replication

Rights-GUID

f98340fb-7c5b-4cdb-a00b-2ebdfa115a96

Applies-To

Configuration

DMD

Domain-DNS

Enable-Per-User-Reversibly-Encrypted-Password

 

Item Description

Description

Extended right that allows users to enable or disable the “reversible encrypted password” setting for user and computer objects.

CN

Enable-Per-User-Reversibly-Encrypted-Password

Display-Name

Enable Per User Reversibly Encrypted Password

Rights-GUID

05c74c5e-4deb-43b4-bd9f-86664c2a7fd5

Applies-To

Domain-DNS

Generate-RSoP-Logging

 

Item Description

Description

The user who has this right on an OU/Domain will be able to generate logging mode RSoP data for the users/computers within the OU.

CN

Generate-RSoP-Logging

Display-Name

Generate Resultant Set of Policy (Logging)

Rights-GUID

b7b1b3de-ab09-4242-9e30-9980e5d322f7

Applies-To

Domain-DNS

Organizational-Unit

Generate-RSoP-Planning

 

Item Description

Description

The user who has this right on an OU/Domain will be able to generate planning mode RSoP data for the users/computers within the OU.

CN

Generate-RSoP-Planning

Display-Name

Generate Resultant Set of Policy (Planning)

Rights-GUID

b7b1b3dd-ab09-4242-9e30-9980e5d322f7

Applies-To

Domain-DNS

Organizational-Unit

Migrate-SID-History

 

Item Description

Description

Extended right that enables a user to migrate the SID-History without administrator privileges.

CN

Migrate-SID-History

Display-Name

Migrate SID History

Rights-GUID

BA33815A-4F93-4c76-87F3-57574BFF8109

Applies-To

Domain-DNS

Reanimate-Tombstones

 

Item Description

Description

Extended right that allows deleted schema elements to be restored.

CN

Reanimate-Tombstones

Display-Name

Reanimate Tombstones

Rights-GUID

45EC5156-DB7E-47bb-B53F-DBEB2D03C40F

Applies-To

Configuration

DMD

Domain-DNS

Refresh-Group-Cache

 

Item Description

Description

For Universal group membership caching. Universal group membership caching relies on caching group memberships and this control access right is used to provide administrators/operators with rights to cause an immediate refresh of the cache, contacting an available global catalog server.

CN

Refresh-Group-Cache

Display-Name

Refresh Group Cache for Logons

Rights-GUID

9432c620-033c-4db7-8b58-14ef6d0bf477

Applies-To

NTDS-DSA

Valid-Accesses

0x100

Localization-Display-ID

56

SAM-Enumerate-Entire-Domain

 

Item Description

Description

This extended right is used to restrict who can be allowed to use down-level APIs such as NetQueryDisplayInformation and NetUser/GroupEnum and enumerate the entire domain.

CN

SAM-Enumerate-Entire-Domain

Display-Name

Enumerate Entire SAM Domain

Rights-GUID

91d67418-0135-4acc-8d79-c08e857cfbec

Applies-To

Sam-Server

Unexpire-Password

 

Item Description

Description

Extended right that allows a user to restore an expired password for a user object.

CN

Unexpire-Password

Display-Name

Unexpire Password

Rights-GUID

ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501

Applies-To

Domain-DNS

Update-Password-Not-Required-Bit

 

Item Description

Description

Extended right that allows a user to enable or disable the “password not required” setting for user objects.

CN

Update-Password-Not-Required-Bit

Display-Name

Update Password Not Required Bit

Rights-GUID

280f369c-67c7-438e-ae98-1d46f3c6f541

Applies-To

Domain-DNS

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft