Appendix D: Active Directory Extended Rights

CN (Common Name)

Every object in the DS has a naming attribute from which its relative distinguished name is formed. The naming attribute for control-Access-Right objects is Common-Name.

Rights-GUID

The unique ID for identifying a control access right.

Description

Extended right needed to cancel a replication sync.

Display-Name

Abandon Replication

Applies-To

NTDS-DSA

Description

Extended right needed at the NC root to add an object with a specific GUID.

Display-Name

Add GUID

Applies-To

Domain-DNS

Description

Extended right needed to request a pool of RIDs.

Display-Name

Allocate RIDs

Applies-To

NTDS-DSA

Description

Extended right used by Group Policy engine to determine whether a GPO applies to a particular user or computer.

Display-Name

Apply Group Policy

Applies-To

Group-Policy-Container

Description

Extended right needed to cause certificate enrollment.

Display-Name

Check Stale Phantoms

Applies-To

PKI-Certificate-Template

Description

Extended right needed to change the Domain Master role owner.

Display-Name

Change Domain Master

Applies-To

Cross-Ref-Container

Description

Extended right needed to change the Infrastructure FSMO role owner.

Display-Name

Change Infrastructure Master

Applies-To

Infrastructure-Update

Description

Extended right needed to change the PDC Emulator role owner.

Display-Name

Change PDC

Applies-To

Domain-DNS

Description

Extended right needed to change the RID-Master role owner.

Display-Name

Change RID Master

Applies-To

RID-Manager

Description

Extended right needed to change the Schema Master FSMO role owner.

Display-Name

Change Schema Master

Applies-To

DMD

Description

Extended right to force the directory service to do garbage collection.

Display-Name

Do Garbage Collection

Applies-To

NTDS-DSA

Description

Legacy SAM right.

Display-Name

Domain Administer Server

Applies-To

Sam-Server

Description

Extended right needed to force the directory service to check stale phantom objects.

Display-Name

Check Stale Phantoms

Applies-To

NTDS-DSA

Description

Extended right needed to do a replica install.

Display-Name

Add/Remove Replica In Domain

Applies-To

Domain-DNS

Description

Extended right needed to replicate changes from a given NC.

Note
This extended right was modified in Windows Server 2003 – refer to the Windows Server 2003 Active Directory Schema Extended Rights section for details on how this right works in Windows Server 2003.

Display-Name

Replicating Directory Changes

Applies-To

Configuration

DMD

Domain-DNS

Description

Extended right needed to update the replication topology for a given NC.

Display-Name

Manage Replication Topology

Applies-To

Configuration

DMD

Domain-DNS

Description

Extended right needed to synchronize replication from a given NC.

Display-Name

Replication Synchronization

Applies-To

Configuration

DMD

Domain-DNS

Description

Allows opening the connector queue.

Display-Name

Open Connector Queue

Applies-To

Site

Description

Allows peeking at messages in the queue.

Display-Name

Peek Message

Applies-To

MSMQ-Queue

Description

Allows peeking at messages in the Computer Journal queue.

Display-Name

Peek Computer Journal

Applies-To

MSMQ-Configuration

Description

Allows peeking at messages in the Dead Letter queue.

Display-Name

Peek Dead Letter

Applies-To

MSMQ-Configuration

Description

Allows receiving messages from the queue.

Display-Name

Receive Message

Applies-To

MSMQ-Queue

Description

Allows receiving messages from the Computer Journal queue.

Display-Name

Receive Computer Journal

Applies-To

MSMQ-Configuration

Description

Allows receiving messages from the Dead Letter queue.

Display-Name

Receive Dead Letter

Applies-To

MSMQ-Configuration

Description

Allows receiving messages from the queue’s Journal.

Display-Name

Receive Journal

Applies-To

MSMQ-Queue

Description

Allows sending messages to the queue.

Display-Name

Send Message

Applies-To

MSMQ-Queue

Description

Extended right checked when opening address book object for address book views.

Display-Name

Open Address List

Applies-To

Address-Book-Container

Description

Extended right to force the DS to recalculate the hierarchy.

Display-Name

Recalculate Hierarchy

Applies-To

NTDS-DSA

Description

Extended right needed to force DS to recompute ACL inheritance on a naming context.

Display-Name

Recalculate Security Inheritance

Applies-To

NTDS-DSA

Description

Exchange right: allows receiving mail as a given mailbox.

Display-Name

Receive As

Applies-To

Computer

User

Description

Exchange right: allows sending mail as the mailbox.

Display-Name

Send As

Applies-To

Computer

User

Description

Exchange right: allows sending to a mailbox.

Display-Name

Send To

Applies-To

Group

Description

Extended right to force a schema cache update.

Display-Name

Update Schema Cache

Applies-To

DMD

Description

Permits changing password on user account.

Display-Name

Change Password

Applies-To

Computer

User

Description

Permits resetting password on user account.

Display-Name

Reset Password

Applies-To

Computer

User

Description

This extended right controls who can authenticate to a particular machine or service. It is applied on computer, user and InetOrgPerson objects. It is also applicable on the domain object if access is allowed for the entire domain. It can be applied to OUs to permit users to be able to set inheritable ACEs on OUs containing a set of user/computer objects.

Display-Name

Allowed to Authenticate

Applies-To

Computer

inetOrgPerson

User

Description

Extended right that enables users to create an inbound-only trust between forests by adding them to the appropriate group.

Display-Name

Create Inbound Forest Trust

Applies-To

Domain-DNS

Description

Extended right, which should be granted to the partitions container, that allows the Rendom.exe or prepare operation to be used in a domain rename. This control access right also appears as an audit-only right when the Redom.exe or execute step operations are performed.

Display-Name

Execute Forest Update Script

Applies-To

Cross-Ref-Container

Description

Control access right which allows a user to query the user’s own quotas.

Display-Name

Query Self Quota

Applies-To

ms-DS-Quota-Container

Description

Extended right needed to replicate only those changes from a given NC that are also replicated to the Global Catalog (which excludes secret domain data). This constraint is only meaningful for Domain NCs.

Note
In Windows 2000, this extended right allowed the replication of all data including secret data. In Windows Server 2003, this right does not allow the replication of secret data. To replicate all data including secret data, the DS-Replication-Get-Changes-All extended right is required (this new extended right was introduced in Windows Server 2003).

Display-Name

Replicating Directory Changes

Applies-To

Configuration

DMD

Domain-DNS

Description

Control access right that allows the replication of all data in a given replication NC, including secret domain data.

Note
In Windows Server 2003, the Get Replication Changes Extended right has been modified such that it only allows the replication of all data in a given replication NC that is also replicated to the Global Catalog (which excludes secret domain data).

Display-Name

Replicating Directory Changes All

Applies-To

Configuration

DMD

Domain-DNS

Description

Extended control access right that allows the reading of replication monitoring data, such as replication status and object metadata.

Display-Name

Monitor Active Directory Replication

Applies-To

Configuration

DMD

Domain-DNS

Description

Extended right that allows users to enable or disable the “reversible encrypted password” setting for user and computer objects.

Display-Name

Enable Per User Reversibly Encrypted Password

Applies-To

Domain-DNS

Description

The user who has this right on an OU/Domain will be able to generate logging mode RSoP data for the users/computers within the OU.

Display-Name

Generate Resultant Set of Policy (Logging)

Applies-To

Domain-DNS

Organizational-Unit

Description

The user who has this right on an OU/Domain will be able to generate planning mode RSoP data for the users/computers within the OU.

Display-Name

Generate Resultant Set of Policy (Planning)

Applies-To

Domain-DNS

Organizational-Unit

Description

Extended right that enables a user to migrate the SID-History without administrator privileges.

Display-Name

Migrate SID History

Applies-To

Domain-DNS

Description

Extended right that allows deleted schema elements to be restored.

Display-Name

Reanimate Tombstones

Applies-To

Configuration

DMD

Domain-DNS

Description

For Universal group membership caching. Universal group membership caching relies on caching group memberships and this control access right is used to provide administrators/operators with rights to cause an immediate refresh of the cache, contacting an available global catalog server.

Display-Name

Refresh Group Cache for Logons

Applies-To

NTDS-DSA

Localization-Display-ID

56

Description

This extended right is used to restrict who can be allowed to use down-level APIs such as NetQueryDisplayInformation and NetUser/GroupEnum and enumerate the entire domain.

Display-Name

Enumerate Entire SAM Domain

Applies-To

Sam-Server

Description

Extended right that allows a user to restore an expired password for a user object.

Display-Name

Unexpire Password

Applies-To

Domain-DNS

Description

Extended right that allows a user to enable or disable the “password not required” setting for user objects.

Display-Name

Update Password Not Required Bit

Applies-To

Domain-DNS