sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-20 14:03:59 +03:00
Code
samba-mirror/source4/setup/provision_users.ldif

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

444 lines
14 KiB
Plaintext
Raw Normal View History

s4:provision_users.ldif - Put potential primary groups in front of the file (So they can be always found by the SAMLDB module)
2009-10-02 15:21:17 +02:00
# Add default primary groups (domain users, domain guests, domain computers &
# domain controllers) - needed for the users to find valid primary groups
# (samldb module)
s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-08-26 03:51:45 +02:00
dn: CN=Domain Users,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: All domain users
objectSid: ${DOMAINSID}-513
sAMAccountName: Domain Users
isCriticalSystemObject: TRUE
dn: CN=Domain Guests,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: All domain guests
objectSid: ${DOMAINSID}-514
sAMAccountName: Domain Guests
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Put potential primary groups in front of the file (So they can be always found by the SAMLDB module)
2009-10-02 15:21:17 +02:00
dn: CN=Domain Computers,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: All workstations and servers joined to the domain
objectSid: ${DOMAINSID}-515
sAMAccountName: Domain Computers
isCriticalSystemObject: TRUE
dn: CN=Domain Controllers,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: All domain controllers in the domain
objectSid: ${DOMAINSID}-516
adminCount: 1
sAMAccountName: Domain Controllers
isCriticalSystemObject: TRUE
s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-08-26 03:51:45 +02:00
# Add users
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Administrator,CN=Users,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: user
description: Built-in account for administering the computer/domain
s4:provision_users.ldif - fix up Administrator's "userAccountControl"
2010-05-13 11:22:43 +02:00
userAccountControl: 512
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectSid: ${DOMAINSID}-500
adminCount: 1
accountExpires: Windows default is 9223372036854775807, not -1. (This used to be commit be47cc7fdfa3cae0508e564f38b793aa27b6eb92)
2008-03-06 05:56:49 -06:00
accountExpires: 9223372036854775807
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
sAMAccountName: Administrator
s4:provision - switch to "clearTextPassword" for setting passwords This is the default password set/change attribute for s4 specific purposes (otherwise in respect to Windows it's "unicodePwd"). We move away from "userPassword" since on Windows it's not activated by default - and s4 will follow soon.
2010-11-09 13:22:00 +01:00
clearTextPassword:: ${ADMINPASS_B64}
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 12:48:18 +02:00
isCriticalSystemObject: TRUE
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Guest,CN=Users,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: user
description: Built-in account for guest access to the computer/domain
r16166: Remove hexidecimal constants from the Samba4 provision files. This change is required for compatibility with the OSX client, in particular, but returning 0x80000002 rather than -2147483646 violates what LDAP clients expect in general. Andrew Bartlett (This used to be commit 81f3cd1c4592d2108d521acd701ed4a70a23c465)
2006-06-12 20:00:18 +00:00
userAccountControl: 66082
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
primaryGroupID: 514
objectSid: ${DOMAINSID}-501
sAMAccountName: Guest
isCriticalSystemObject: TRUE
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
dn: CN=krbtgt,CN=Users,${DOMAINDN}
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
description: Key Distribution Center Service Account
showInAdvancedViewOnly: TRUE
userAccountControl: 514
objectSid: ${DOMAINSID}-502
adminCount: 1
accountExpires: 9223372036854775807
sAMAccountName: krbtgt
servicePrincipalName: kadmin/changepw
s4:provision - switch to "clearTextPassword" for setting passwords This is the default password set/change attribute for s4 specific purposes (otherwise in respect to Windows it's "unicodePwd"). We move away from "userPassword" since on Windows it's not activated by default - and s4 will follow soon.
2010-11-09 13:22:00 +01:00
clearTextPassword:: ${KRBTGTPASS_B64}
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 12:48:18 +02:00
isCriticalSystemObject: TRUE
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-08-26 03:51:45 +02:00
# Add other groups
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
dn: CN=Enterprise Read-only Domain Controllers,CN=Users,${DOMAINDN}
s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-08-26 03:51:45 +02:00
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix up errors on existing entries Compared against Windows Server 2008
2010-01-11 21:57:32 +01:00
description: Members of this group are Read-Only Domain Controllers in the enterprise
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
objectSid: ${DOMAINSID}-498
typo: Change case to match DN Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-08-02 12:52:22 +12:00
sAMAccountName: Enterprise Read-only Domain Controllers
s4:provision_users.ldif - Fix up errors on existing entries Compared against Windows Server 2008
2010-01-11 21:57:32 +01:00
groupType: -2147483640
s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-08-26 03:51:45 +02:00
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
dn: CN=Domain Admins,CN=Users,${DOMAINDN}
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
objectClass: top
objectClass: group
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
description: Designated administrators of the domain
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
member: CN=Administrator,CN=Users,${DOMAINDN}
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
objectSid: ${DOMAINSID}-512
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
adminCount: 1
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
sAMAccountName: Domain Admins
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
isCriticalSystemObject: TRUE
dn: CN=Cert Publishers,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
description: Members of this group are permitted to publish certificates to the directory
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
objectSid: ${DOMAINSID}-517
sAMAccountName: Cert Publishers
s4:provision_users.ldif - Fix up errors on existing entries Compared against Windows Server 2008
2010-01-11 21:57:32 +01:00
groupType: -2147483644
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
dn: CN=Schema Admins,CN=Users,${DOMAINDN}
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
objectClass: top
objectClass: group
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
description: Designated administrators of the schema
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
member: CN=Administrator,CN=Users,${DOMAINDN}
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
objectSid: ${DOMAINSID}-518
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
adminCount: 1
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
sAMAccountName: Schema Admins
s4:provision_users.ldif - Fix up errors on existing entries Compared against Windows Server 2008
2010-01-11 21:57:32 +01:00
groupType: -2147483640
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
dn: CN=Enterprise Admins,CN=Users,${DOMAINDN}
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
objectClass: top
objectClass: group
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
description: Designated administrators of the enterprise
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
member: CN=Administrator,CN=Users,${DOMAINDN}
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
objectSid: ${DOMAINSID}-519
adminCount: 1
sAMAccountName: Enterprise Admins
s4:provision_users.ldif - Fix up errors on existing entries Compared against Windows Server 2008
2010-01-11 21:57:32 +01:00
groupType: -2147483640
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
dn: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
objectClass: top
objectClass: group
s4:provision_users.ldif - change a group description to be correct
2010-06-24 09:14:24 +02:00
description: Members in this group can modify group policy for the domain
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
member: CN=Administrator,CN=Users,${DOMAINDN}
objectSid: ${DOMAINSID}-520
sAMAccountName: Group Policy Creator Owners
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 05:35:16 +01:00
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
dn: CN=Read-only Domain Controllers,CN=Users,${DOMAINDN}
added some more well known SIDs - thanks to the WSPP LSAT test suite
2008-09-29 16:01:07 -07:00
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix up errors on existing entries Compared against Windows Server 2008
2010-01-11 21:57:32 +01:00
description: Members of this group are Read-Only Domain Controllers in the domain
added some more well known SIDs - thanks to the WSPP LSAT test suite
2008-09-29 16:01:07 -07:00
objectSid: ${DOMAINSID}-521
s4:provision_users.ldif - Fix up errors on existing entries Compared against Windows Server 2008
2010-01-11 21:57:32 +01:00
adminCount: 1
typo: Change case to match DN Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-08-02 12:52:22 +12:00
sAMAccountName: Read-only Domain Controllers
added some more well known SIDs - thanks to the WSPP LSAT test suite
2008-09-29 16:01:07 -07:00
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
dn: CN=RAS and IAS Servers,CN=Users,${DOMAINDN}
added some more well known SIDs - thanks to the WSPP LSAT test suite
2008-09-29 16:01:07 -07:00
objectClass: top
objectClass: group
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
description: Servers in this group can access remote access properties of users
objectSid: ${DOMAINSID}-553
sAMAccountName: RAS and IAS Servers
added some more well known SIDs - thanks to the WSPP LSAT test suite
2008-09-29 16:01:07 -07:00
groupType: -2147483644
isCriticalSystemObject: TRUE
s4:provision_users.ldif - add the restant part of the objects needing for RODC support RODC = Read Only Domain Controllers Compared against Windows Server 2008
2010-01-11 22:01:42 +01:00
dn: CN=Allowed RODC Password Replication Group,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
description: Members in this group can have their passwords replicated to all read-only domain controllers in the domain
s4:provision_users.ldif - add the restant part of the objects needing for RODC support RODC = Read Only Domain Controllers Compared against Windows Server 2008
2010-01-11 22:01:42 +01:00
objectSid: ${DOMAINSID}-571
sAMAccountName: Allowed RODC Password Replication Group
groupType: -2147483644
isCriticalSystemObject: TRUE
dn: CN=Denied RODC Password Replication Group,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
description: Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain
member: CN=Read-only Domain Controllers,CN=Users,${DOMAINDN}
s4:provision_users.ldif - add the restant part of the objects needing for RODC support RODC = Read Only Domain Controllers Compared against Windows Server 2008
2010-01-11 22:01:42 +01:00
member: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
member: CN=Domain Admins,CN=Users,${DOMAINDN}
member: CN=Cert Publishers,CN=Users,${DOMAINDN}
member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
member: CN=Schema Admins,CN=Users,${DOMAINDN}
member: CN=Domain Controllers,CN=Users,${DOMAINDN}
member: CN=krbtgt,CN=Users,${DOMAINDN}
objectSid: ${DOMAINSID}-572
sAMAccountName: Denied RODC Password Replication Group
groupType: -2147483644
isCriticalSystemObject: TRUE
s4:provision_users.ldif: Add Protected Users group Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-02-01 21:04:40 +13:00
dn: CN=Protected Users,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: Members of this group are afforded additional protections against authentication security threats
objectSid: ${DOMAINSID}-525
sAMAccountName: Protected Users
groupType: -2147483646
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Add a comment that some objects under "Users" are now located elsewhere This is needed due to the new RID/SID distribution system
2010-01-13 17:39:28 +01:00
# NOTICE: Some other users and groups which rely on automatic SIDs are located
# in "provision_self_join_modify.ldif"
s4:Foreign security principals - Fix them up I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-06 19:57:50 +02:00
# Add foreign security principals
dn: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-4
dn: CN=S-1-5-9,CN=ForeignSecurityPrincipals,${DOMAINDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-9
dn: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-11
s4:provision_users.ldif - Add objects for IIS Some WSPP locations point out that beginning with Windows Server 2008 they're also per default present. Compared against Windows Server 2008
2010-01-10 14:20:09 +01:00
dn: CN=S-1-5-17,CN=ForeignSecurityPrincipals,${DOMAINDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-17
s4:Foreign security principals - Fix them up I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-06 19:57:50 +02:00
# Add builtin objects
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Administrators,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: top
objectClass: group
description: Administrators have complete and unrestricted access to the computer/domain
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
member: CN=Domain Admins,CN=Users,${DOMAINDN}
member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
member: CN=Administrator,CN=Users,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectSid: S-1-5-32-544
adminCount: 1
sAMAccountName: Administrators
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 12:48:18 +02:00
isCriticalSystemObject: TRUE
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Users,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
description: Users are prevented from making accidental or intentional system-wide changes and can run most applications
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
member: CN=Domain Users,CN=Users,${DOMAINDN}
s4:Foreign security principals - Fix them up I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-06 19:57:50 +02:00
member: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectSid: S-1-5-32-545
sAMAccountName: Users
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Guests,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: top
objectClass: group
description: Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
member: CN=Domain Guests,CN=Users,${DOMAINDN}
member: CN=Guest,CN=Users,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectSid: S-1-5-32-546
sAMAccountName: Guests
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
dn: CN=Account Operators,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: Members can administer domain user and group accounts
objectSid: S-1-5-32-548
adminCount: 1
sAMAccountName: Account Operators
systemFlags: -1946157056
groupType: -2147483643
isCriticalSystemObject: TRUE
dn: CN=Server Operators,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: Members can administer domain servers
objectSid: S-1-5-32-549
adminCount: 1
sAMAccountName: Server Operators
systemFlags: -1946157056
groupType: -2147483643
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Print Operators,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: top
objectClass: group
description: Members can administer domain printers
objectSid: S-1-5-32-550
adminCount: 1
sAMAccountName: Print Operators
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 12:48:18 +02:00
isCriticalSystemObject: TRUE
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Backup Operators,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: top
objectClass: group
description: Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
objectSid: S-1-5-32-551
adminCount: 1
sAMAccountName: Backup Operators
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 12:48:18 +02:00
isCriticalSystemObject: TRUE
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Replicator,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: top
objectClass: group
description: Supports file replication in a domain
objectSid: S-1-5-32-552
adminCount: 1
sAMAccountName: Replicator
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
dn: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: A backward compatibility group which allows read access on all users and groups in the domain
member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
objectSid: S-1-5-32-554
sAMAccountName: Pre-Windows 2000 Compatible Access
systemFlags: -1946157056
groupType: -2147483643
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Remote Desktop Users,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: top
objectClass: group
description: Members in this group are granted the right to logon remotely
objectSid: S-1-5-32-555
sAMAccountName: Remote Desktop Users
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Network Configuration Operators,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: top
objectClass: group
description: Members in this group can have some administrative privileges to manage configuration of networking features
objectSid: S-1-5-32-556
sAMAccountName: Network Configuration Operators
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Simple reordering Sorted according the SID - easier for later enhancements.
2010-01-11 21:44:18 +01:00
dn: CN=Incoming Forest Trust Builders,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: Members of this group can create incoming, one-way trusts to this forest
objectSid: S-1-5-32-557
sAMAccountName: Incoming Forest Trust Builders
systemFlags: -1946157056
groupType: -2147483643
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Performance Monitor Users,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
description: Members of this group can access performance counter data locally and remotely
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectSid: S-1-5-32-558
sAMAccountName: Performance Monitor Users
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 17:40:43 +00:00
dn: CN=Performance Log Users,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
description: Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
objectSid: S-1-5-32-559
sAMAccountName: Performance Log Users
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 00:23:09 +00:00
isCriticalSystemObject: TRUE
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 02:26:24 +00:00
dn: CN=Windows Authorization Access Group,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects
s4:Foreign security principals - Fix them up I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-06 19:57:50 +02:00
member: CN=S-1-5-9,CN=ForeignSecurityPrincipals,${DOMAINDN}
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 02:26:24 +00:00
objectSid: S-1-5-32-560
sAMAccountName: Windows Authorization Access Group
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 02:26:24 +00:00
isCriticalSystemObject: TRUE
dn: CN=Terminal Server License Servers,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
description: Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 02:26:24 +00:00
objectSid: S-1-5-32-561
sAMAccountName: Terminal Server License Servers
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 02:26:24 +00:00
isCriticalSystemObject: TRUE
dn: CN=Distributed COM Users,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: Members are allowed to launch, activate and use Distributed COM objects on this machine.
objectSid: S-1-5-32-562
sAMAccountName: Distributed COM Users
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 13:54:45 +02:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 21:26:32 +10:00
groupType: -2147483643
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 02:26:24 +00:00
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Add objects for IIS Some WSPP locations point out that beginning with Windows Server 2008 they're also per default present. Compared against Windows Server 2008
2010-01-10 14:20:09 +01:00
dn: CN=IIS_IUSRS,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
description: Built-in group used by Internet Information Services.
s4:provision_users.ldif - Add objects for IIS Some WSPP locations point out that beginning with Windows Server 2008 they're also per default present. Compared against Windows Server 2008
2010-01-10 14:20:09 +01:00
member: CN=S-1-5-17,CN=ForeignSecurityPrincipals,${DOMAINDN}
objectSid: S-1-5-32-568
sAMAccountName: IIS_IUSRS
systemFlags: -1946157056
groupType: -2147483643
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Add additional BUILTIN objects Compared against Windows Server 2008
2010-01-11 22:12:01 +01:00
dn: CN=Cryptographic Operators,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: Members are authorized to perform cryptographic operations.
objectSid: S-1-5-32-569
sAMAccountName: Cryptographic Operators
systemFlags: -1946157056
groupType: -2147483643
isCriticalSystemObject: TRUE
dn: CN=Event Log Readers,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
description: Members of this group can read event logs from local machine
s4:provision_users.ldif - Add additional BUILTIN objects Compared against Windows Server 2008
2010-01-11 22:12:01 +01:00
objectSid: S-1-5-32-573
sAMAccountName: Event Log Readers
systemFlags: -1946157056
groupType: -2147483643
isCriticalSystemObject: TRUE
dn: CN=Certificate Service DCOM Access,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
s4:provision_users.ldif - Fix typos in user/group objects
2010-05-13 11:13:26 +02:00
description: Members of this group are allowed to connect to Certification Authorities in the enterprise
s4:provision_users.ldif - Add additional BUILTIN objects Compared against Windows Server 2008
2010-01-11 22:12:01 +01:00
objectSid: S-1-5-32-574
sAMAccountName: Certificate Service DCOM Access
systemFlags: -1946157056
groupType: -2147483643
isCriticalSystemObject: TRUE
Copy Permalink