AD Schema Privilege

  • Thread starter Thread starter SpecialK
  • Start date Start date
S

SpecialK

Hi allIs there a "backdoor" or way for an application installation to
programmatically, get elevated privileges to update the AD schema?

Eg. the Schema Admins group is empty and the Schema partition is not set to
be writable, however an end-user attempts to install an application on their
workstation which tries to update the schema as part of the install. To be
able to isntall the app the application is already in an elevated privilege
state. Is there a way to ensure that there is no chance a rogue app
installed by an end-user can update the schema?
I would like to ensure that in this situation, the schema update by the
users application install should FAILThanks
 
I would start by shooting any developer that wrote a desktop app that would
extend my schema!
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Schema Privileges 1
AD Schema Security 2
adprep /forestprep There is a schema conflict with Exchange 2000 1
Missing schema attributes in ADSIEdit 2
Schema 2
Error 0x57 importing AD schema export into ADAM 2
remove schema objects 2
ADPREP : Schema update failed in recalculating validation cache 6

Back
Top