mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
d6e0f43ab9
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
836 lines
31 KiB
Plaintext
836 lines
31 KiB
Plaintext
# This is the schema of the extended rights built in to Active Directory
|
|
#
|
|
# This file is needed to document the rights that are available and to
|
|
# create the appropritate objects in the AD database, which are used
|
|
# by the administrative tools.
|
|
#
|
|
# The primary source is MS-ADTS 12/1/2017 v47.0 under 6.1.1.2.7
|
|
# That document is licenced thusly:
|
|
#
|
|
# Intellectual Property Rights Notice for Open Specifications Documentation
|
|
#
|
|
|
|
# Technical Documentation. Microsoft publishes Open Specifications
|
|
# documentation (“this documentation”) for protocols, file formats,
|
|
# data portability, computer languages, and standards
|
|
# support. Additionally, overview documents cover inter-protocol
|
|
# relationships and interactions.
|
|
|
|
# Copyrights. This documentation is covered by Microsoft
|
|
# copyrights. Regardless of any other terms that are contained in the
|
|
# terms of use for the Microsoft website that hosts this
|
|
# documentation, you can make copies of it in order to develop
|
|
# implementations of the technologies that are described in this
|
|
# documentation and can distribute portions of it in your
|
|
# implementations that use these technologies or in your documentation
|
|
# as necessary to properly document the implementation. You can also
|
|
# distribute in your implementation, with or without modification, any
|
|
# schemas, IDLs, or code samples that are included in the
|
|
# documentation. This permission also applies to any documents that
|
|
# are referenced in the Open Specifications documentation.
|
|
|
|
# No Trade Secrets. Microsoft does not claim any trade secret rights
|
|
# in this documentation.
|
|
|
|
# Patents. Microsoft has patents that might cover your implementations
|
|
# of the technologies described in the Open Specifications
|
|
# documentation. Neither this notice nor Microsoft's delivery of this
|
|
# documentation grants any licenses under those patents or any other
|
|
# Microsoft patents. However, a given Open Specifications document
|
|
# might be covered by the Microsoft Open Specifications Promise or the
|
|
# Microsoft Community Promise. If you would prefer a written license,
|
|
# or if the technologies described in this documentation are not
|
|
# covered by the Open Specifications Promise or Community Promise, as
|
|
# applicable, patent licenses are available by contacting
|
|
# iplg@microsoft.com.
|
|
|
|
# License Programs. To see all of the protocols in scope under a
|
|
# specific license program and the associated patents, visit the
|
|
# Patent Map.
|
|
|
|
# Trademarks. The names of companies and products contained in this
|
|
# documentation might be covered by trademarks or similar intellectual
|
|
# property rights. This notice does not grant any licenses under those
|
|
# rights. For a list of Microsoft trademarks, visit
|
|
# www.microsoft.com/trademarks.
|
|
|
|
# Fictitious Names. The example companies, organizations, products,
|
|
# domain names, email addresses, logos, people, places, and events
|
|
# that are depicted in this documentation are fictitious. No
|
|
# association with any real company, organization, product, domain
|
|
# name, email address, logo, person, place, or event is intended or
|
|
# should be inferred.
|
|
|
|
# Reservation of Rights. All other rights are reserved, and this
|
|
# notice does not grant any rights other than as specifically
|
|
# described above, whether by implication, estoppel, or otherwise.
|
|
|
|
# Tools. The Open Specifications documentation does not require the
|
|
# use of Microsoft programming tools or programming environments in
|
|
# order for you to develop an implementation. If you have access to
|
|
# Microsoft programming tools and environments, you are free to take
|
|
# advantage of them. Certain Open Specifications documents are
|
|
# intended for use in conjunction with publicly available standards
|
|
# specifications and network programming art and, as such, assume that
|
|
# the reader either is familiar with the aforementioned material or
|
|
# has immediate access to it.
|
|
|
|
# Support. For questions and support, please contact dochelp@microsoft.com.
|
|
|
|
#
|
|
# Additionally, changes for Windows 2012 and above are sourced from
|
|
#
|
|
# https://github.com/MicrosoftDocs/windowsserverdocs/blob/master/WindowsServerDocs/identity/ad-ds/deploy/Schema-Updates.md
|
|
#
|
|
# in this repoo this is kept in
|
|
# source4/setup/adprep/WindowsServerDocs/Schema-Updates.md
|
|
# and is licenced under the MIT licence
|
|
#
|
|
# The MIT License (MIT)
|
|
# Copyright (c) Microsoft Corporation
|
|
|
|
# Permission is hereby granted, free of charge, to any person
|
|
# obtaining a copy of this software and associated documentation files
|
|
# (the "Software"), to deal in the Software without restriction,
|
|
# including without limitation the rights to use, copy, modify, merge,
|
|
# publish, distribute, sublicense, and/or sell copies of the Software,
|
|
# and to permit persons to whom the Software is furnished to do so,
|
|
# subject to the following conditions:
|
|
|
|
# The above copyright notice and this permission notice shall be
|
|
# included in all copies or substantial portions of the Software.
|
|
|
|
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
|
# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
|
# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
|
# TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
|
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
#
|
|
|
|
# 6.1.1.2.7.1 controlAccessRight objects
|
|
# All controlAccessRight objects have:
|
|
# objectClass: controlAccessRight
|
|
# rightsGuid: This value is the identifier of the control access right
|
|
# used for security descriptors and SDDL.
|
|
# appliesTo: Each value in this attribute is a GUID, with each GUID
|
|
# equaling an attribute schemaIDGUID on a schema object
|
|
# defining a class in the schema NC. This class defines the
|
|
# objects in which the control access right can be a
|
|
# security descriptor for. The appliesTo values on the
|
|
# controlAccessRight are not enforced by the directory
|
|
# server; that is, the controlAccessRight can be included
|
|
# in security descriptors of objects of classes not
|
|
# specified in the appliesTo attribute.
|
|
# localizationDisplayId: This is implementation-specific information
|
|
# for the administrative application.
|
|
# validAccesses: This is implementation-specific information for the
|
|
# administrative application.
|
|
#
|
|
# NOTE: while it is claimed that validAccesses is implementation-specfic
|
|
# it can be determined by careful reading of other parts of MS-ADTS
|
|
|
|
dn: CN=Change-Rid-Master,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Change Rid Master
|
|
rightsGuid: d58d5f36-0a98-11d1-adbb-00c04fd8d5cd
|
|
appliesTo: 6617188d-8f3c-11d0-afda-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Do-Garbage-Collection,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Do Garbage Collection
|
|
rightsGuid: fec364e0-0a98-11d1-adbb-00c04fd8d5cd
|
|
appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
|
|
validAccesses: 256
|
|
|
|
dn: CN=Recalculate-Hierarchy,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Recalculate Hierarchy
|
|
rightsGuid: 0bc1554e-0a99-11d1-adbb-00c04fd8d5cd
|
|
appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
|
|
validAccesses: 256
|
|
|
|
dn: CN=Allocate-Rids,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Allocate Rids
|
|
rightsGuid: 1abd7cf8-0a99-11d1-adbb-00c04fd8d5cd
|
|
appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
|
|
validAccesses: 256
|
|
|
|
dn: CN=Change-PDC,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Change PDC
|
|
rightsGuid: bae50096-4752-11d1-9052-00c04fc2d4cf
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Add-GUID,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Add GUID
|
|
rightsGuid: 440820ad-65b4-11d1-a3da-0000f875ae0d
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Change-Domain-Master,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Change Domain Master
|
|
rightsGuid: 014bf69c-7b3b-11d1-85f6-08002be74fab
|
|
appliesTo: ef9e60e0-56f7-11d1-a9c6-0000f80367c1
|
|
validAccesses: 256
|
|
|
|
dn: CN=Public-Information,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Public Information
|
|
rightsGuid: e48d0154-bcf8-11d1-8702-00c04fb96050
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
validAccesses: 48
|
|
|
|
dn: CN=msmq-Receive-Dead-Letter,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: msmq Receive Dead Letter
|
|
rightsGuid: 4b6e08c0-df3c-11d1-9c86-006008764d0e
|
|
appliesTo: 9a0dc344-c100-11d1-bbc5-0080c76670c0
|
|
validAccesses: 256
|
|
|
|
dn: CN=msmq-Peek-Dead-Letter,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: msmq Peek Dead Letter
|
|
rightsGuid: 4b6e08c1-df3c-11d1-9c86-006008764d0e
|
|
appliesTo: 9a0dc344-c100-11d1-bbc5-0080c76670c0
|
|
validAccesses: 256
|
|
|
|
dn: CN=msmq-Receive-computer-Journal,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: msmq Receive computer Journal
|
|
rightsGuid: 4b6e08c2-df3c-11d1-9c86-006008764d0e
|
|
appliesTo: 9a0dc344-c100-11d1-bbc5-0080c76670c0
|
|
validAccesses: 256
|
|
|
|
dn: CN=msmq-Peek-computer-Journal,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: msmq Peek computer Journal
|
|
rightsGuid: 4b6e08c3-df3c-11d1-9c86-006008764d0e
|
|
appliesTo: 9a0dc344-c100-11d1-bbc5-0080c76670c0
|
|
validAccesses: 256
|
|
|
|
dn: CN=msmq-Receive,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: msmq Receive
|
|
rightsGuid: 06bd3200-df3e-11d1-9c86-006008764d0e
|
|
appliesTo: 9a0dc343-c100-11d1-bbc5-0080c76670c0
|
|
validAccesses: 256
|
|
|
|
dn: CN=msmq-Peek,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: msmq Peek
|
|
rightsGuid: 06bd3201-df3e-11d1-9c86-006008764d0e
|
|
appliesTo: 9a0dc343-c100-11d1-bbc5-0080c76670c0
|
|
validAccesses: 256
|
|
|
|
dn: CN=msmq-Send,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: msmq Send
|
|
rightsGuid: 06bd3202-df3e-11d1-9c86-006008764d0e
|
|
appliesTo: 9a0dc343-c100-11d1-bbc5-0080c76670c0
|
|
appliesTo: 46b27aac-aafa-4ffb-b773-e5bf621ee87b
|
|
validAccesses: 256
|
|
|
|
dn: CN=msmq-Receive-journal,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: msmq Receive journal
|
|
rightsGuid: 06bd3203-df3e-11d1-9c86-006008764d0e
|
|
appliesTo: 9a0dc343-c100-11d1-bbc5-0080c76670c0
|
|
validAccesses: 256
|
|
|
|
dn: CN=msmq-Open-Connector,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: msmq Open Connector
|
|
rightsGuid: b4e60130-df3f-11d1-9c86-006008764d0e
|
|
appliesTo: bf967ab3-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 256
|
|
|
|
dn: CN=Apply-Group-Policy,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Apply Group Policy
|
|
rightsGuid: edacfd8f-ffb3-11d1-b41d-00a0c968f939
|
|
appliesTo: f30e3bc2-9ff0-11d1-b603-0000f80367c1
|
|
validAccesses: 256
|
|
|
|
dn: CN=RAS-Information,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Remote Access Information
|
|
rightsGuid: 037088f8-0ae1-11d2-b422-00a0c968f939
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 48
|
|
|
|
dn: CN=DS-Install-Replica,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DS Install Replica
|
|
rightsGuid: 9923a32a-3607-11d2-b9be-0000f87a36b2
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Change-Infrastructure-Master,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Change Infrastructure Master
|
|
rightsGuid: cc17b1fb-33d9-11d2-97d4-00c04fd8d5cd
|
|
appliesTo: 2df90d89-009f-11d2-aa4c-00c04fd7d83a
|
|
validAccesses: 256
|
|
|
|
dn: CN=Update-Schema-Cache,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Update Schema Cache
|
|
rightsGuid: be2bb760-7f46-11d2-b9ad-00c04f79f805
|
|
appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 256
|
|
|
|
dn: CN=Recalculate-Security-Inheritance,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Recalculate Security Inheritance
|
|
rightsGuid: 62dd28a8-7f46-11d2-b9ad-00c04f79f805
|
|
appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
|
|
validAccesses: 256
|
|
|
|
dn: CN=DS-Check-Stale-Phantoms,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DS Check Stale Phantoms
|
|
rightsGuid: 69ae6200-7f46-11d2-b9ad-00c04f79f805
|
|
appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
|
|
validAccesses: 256
|
|
|
|
dn: CN=Certificate-Enrollment,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Certificate Enrollment
|
|
rightsGuid: 0e10c968-78fb-11d2-90d4-00c04f79dc55
|
|
appliesTo: e5209ca2-3bba-11d2-90cc-00c04fd91ab1
|
|
validAccesses: 256
|
|
|
|
dn: CN=Self-Membership,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Self Membership
|
|
rightsGuid: bf9679c0-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967a9c-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 8
|
|
|
|
dn: CN=Validated-DNS-Host-Name,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Validated DNS Host Name
|
|
rightsGuid: 72e39547-7b18-11d1-adef-00c04fd8d5cd
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
${INC2012}appliesTo: 7b8b558a-93a5-4af7-adca-c017e67f1057
|
|
validAccesses: 8
|
|
|
|
dn: CN=Validated-SPN,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Validated SPN
|
|
rightsGuid: f3a64788-5306-11d1-a9c5-0000f80367c1
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
validAccesses: 8
|
|
|
|
dn: CN=Generate-RSoP-Planning,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Generate RSoP Planning
|
|
rightsGuid: b7b1b3dd-ab09-4242-9e30-9980e5d322f7
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
appliesTo: bf967aa5-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 256
|
|
|
|
dn: CN=Refresh-Group-Cache,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Refresh Group Cache
|
|
rightsGuid: 9432c620-033c-4db7-8b58-14ef6d0bf477
|
|
appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
|
|
validAccesses: 256
|
|
|
|
dn: CN=Reload-SSL-Certificate,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Reload SSL Certificate
|
|
rightsGuid: 1a60ea8d-58a6-4b20-bcdc-fb71eb8a9ff8
|
|
appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
|
|
validAccesses: 256
|
|
|
|
dn: CN=SAM-Enumerate-Entire-Domain,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: SAM Enumerate Entire Domain
|
|
rightsGuid: 91d67418-0135-4acc-8d79-c08e857cfbec
|
|
appliesTo: bf967aad-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 256
|
|
|
|
dn: CN=Generate-RSoP-Logging,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Generate RSoP Logging
|
|
rightsGuid: b7b1b3de-ab09-4242-9e30-9980e5d322f7
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
appliesTo: bf967aa5-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 256
|
|
|
|
dn: CN=Domain-Other-Parameters,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Other Domain Parameters (for use by SAM)
|
|
rightsGuid: b8119fd0-04f6-4762-ab7a-4986c76b3f9a
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 48
|
|
|
|
dn: CN=DNS-Host-Name-Attributes,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DNS Host Name Attributes
|
|
rightsGuid: 72e39547-7b18-11d1-adef-00c04fd8d5cd
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
${INC2012}appliesTo: 7b8b558a-93a5-4af7-adca-c017e67f1057
|
|
validAccesses: 48
|
|
|
|
dn: CN=Create-Inbound-Forest-Trust,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Create Inbound Forest Trust
|
|
rightsGuid: e2a36dc9-ae17-47c3-b58b-be34c55ba633
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=DS-Replication-Get-Changes-All,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DS Replication Get Changes All
|
|
rightsGuid: 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
|
|
appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Migrate-SID-History,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Migrate SID History
|
|
rightsGuid: BA33815A-4F93-4c76-87F3-57574BFF8109
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Reanimate-Tombstones,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Reanimate Tombstones
|
|
rightsGuid: 45EC5156-DB7E-47bb-B53F-DBEB2D03C40F
|
|
appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Allowed-To-Authenticate,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Allowed To Authenticate
|
|
rightsGuid: 68B1D179-0D15-4d4f-AB71-46152E79A7BC
|
|
appliesTo: 4828cc14-1437-45bc-9b07-ad6f015e5f28
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
validAccesses: 256
|
|
|
|
dn: CN=DS-Execute-Intentions-Script,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DS Execute Intentions Script
|
|
rightsGuid: 2f16c4a5-b98e-432c-952a-cb388ba33f2e
|
|
appliesTo: ef9e60e0-56f7-11d1-a9c6-0000f80367c1
|
|
validAccesses: 256
|
|
|
|
dn: CN=DS-Replication-Monitor-Topology,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DS Replication Monitor Topology
|
|
rightsGuid: f98340fb-7c5b-4cdb-a00b-2ebdfa115a96
|
|
appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Update-Password-Not-Required-Bit,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Update Password Not Required Bit
|
|
rightsGuid: 280f369c-67c7-438e-ae98-1d46f3c6f541
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Unexpire-Password,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Unexpire Password
|
|
rightsGuid: ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Enable-Per-User-Reversibly-Encrypted-Password,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Enable Per User Reversibly Encrypted Password
|
|
rightsGuid: 05c74c5e-4deb-43b4-bd9f-86664c2a7fd5
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=DS-Query-Self-Quota,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DS Query Self Quota
|
|
rightsGuid: 4ecc03fe-ffc0-4947-b630-eb672a8a9dbc
|
|
appliesTo: da83fc4f-076f-4aea-b4dc-8f4dab9b5993
|
|
validAccesses: 256
|
|
|
|
dn: CN=Private-Information,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Private Information
|
|
rightsGuid: 91e647de-d96f-4b70-9557-d63ff4f3ccd8
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 4828cc14-1437-45bc-9b07-ad6f015e5f28
|
|
validAccesses: 48
|
|
|
|
dn: CN=MS-TS-GatewayAccess,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: MS-TS-GatewayAccess
|
|
rightsGuid: ffa6f046-ca4b-4feb-b40d-04dfee722543
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
validAccesses: 48
|
|
|
|
dn: CN=Terminal-Server-License-Server,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Terminal Server License Server
|
|
rightsGuid: 5805bc62-bdc9-4428-a5e2-856a0f4c185e
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 4828cc14-1437-45bc-9b07-ad6f015e5f28
|
|
validAccesses: 48
|
|
|
|
dn: CN=Domain-Administer-Server,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Domain Administer Server
|
|
rightsGuid: ab721a52-1e2f-11d0-9819-00aa0040529b
|
|
appliesTo: bf967aad-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 256
|
|
|
|
dn: CN=User-Change-Password,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: User Change Password
|
|
rightsGuid: ab721a53-1e2f-11d0-9819-00aa0040529b
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
validAccesses: 256
|
|
|
|
dn: CN=User-Force-Change-Password,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: User Force Change Password
|
|
rightsGuid: 00299570-246d-11d0-a768-00aa006e0529
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
validAccesses: 256
|
|
|
|
dn: CN=Send-As,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Send As
|
|
rightsGuid: ab721a54-1e2f-11d0-9819-00aa0040529b
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
validAccesses: 256
|
|
|
|
dn: CN=Receive-As,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Receive As
|
|
rightsGuid: ab721a56-1e2f-11d0-9819-00aa0040529b
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
validAccesses: 256
|
|
|
|
dn: CN=Send-To,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Send To
|
|
rightsGuid: ab721a55-1e2f-11d0-9819-00aa0040529b
|
|
appliesTo: bf967a9c-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 256
|
|
|
|
dn: CN=Domain-Password,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Domain Password & Lockout Policies
|
|
rightsGuid: c7407360-20bf-11d0-a768-00aa006e0529
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
appliesTo: 19195a5a-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 48
|
|
|
|
dn: CN=General-Information,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: General Information
|
|
rightsGuid: 59ba2f42-79a2-11d0-9020-00c04fc2d3cf
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 48
|
|
|
|
dn: CN=User-Account-Restrictions,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Account Restrictions
|
|
rightsGuid: 4c164200-20c0-11d0-a768-00aa006e0529
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
${INC2012}appliesTo: 7b8b558a-93a5-4af7-adca-c017e67f1057
|
|
validAccesses: 48
|
|
|
|
dn: CN=User-Logon,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Logon Information
|
|
rightsGuid: 5f202010-79a5-11d0-9020-00c04fc2d4cf
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 48
|
|
|
|
dn: CN=Membership,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Group Membership
|
|
rightsGuid: bc0ac240-79a9-11d0-9020-00c04fc2d4cf
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 48
|
|
|
|
dn: CN=Open-Address-Book,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Open Address Book
|
|
rightsGuid: a1990816-4298-11d1-ade2-00c04fd8d5cd
|
|
appliesTo: 3e74f60f-3e73-11d1-a9c0-0000f80367c1
|
|
validAccesses: 256
|
|
|
|
dn: CN=Personal-Information,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Personal Information
|
|
rightsGuid: 77B5B886-944A-11d1-AEBD-0000F80367C1
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 5cb41ed0-0e4c-11d0-a286-00aa003049e2
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
|
|
${INC2012}appliesTo: 641E87A4-8326-4771-BA2D-C706DF35E35A
|
|
validAccesses: 48
|
|
|
|
dn: CN=Email-Information,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Phone and Mail Options
|
|
rightsGuid: E45795B2-9455-11d1-AEBD-0000F80367C1
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: bf967a9c-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 48
|
|
|
|
dn: CN=Web-Information,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Web Information
|
|
rightsGuid: E45795B3-9455-11d1-AEBD-0000F80367C1
|
|
appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
|
|
appliesTo: 5cb41ed0-0e4c-11d0-a286-00aa003049e2
|
|
appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 48
|
|
|
|
dn: CN=DS-Replication-Get-Changes,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DS Replication Get Changes
|
|
rightsGuid: 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
|
|
appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=DS-Replication-Synchronize,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DS Replication Synchronize
|
|
rightsGuid: 1131f6ab-9c07-11d1-f79f-00c04fc2dcd2
|
|
appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=DS-Replication-Manage-Topology,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DS Replication Manage Topology
|
|
rightsGuid: 1131f6ac-9c07-11d1-f79f-00c04fc2dcd2
|
|
appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Change-Schema-Master,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Change Schema Master
|
|
rightsGuid: e12b56b6-0a95-11d1-adbb-00c04fd8d5cd
|
|
appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 256
|
|
|
|
dn: CN=DS-Replication-Get-Changes-In-Filtered-Set,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: DS Replication Get Changes In Filtered Set
|
|
rightsGuid: 89e95b76-444d-4c62-991a-0facbeda640c
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
|
|
validAccesses: 256
|
|
|
|
dn: CN=Run-Protect-Admin-Groups-Task,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Run Protect Admin Groups Task
|
|
rightsGuid: 7726b9d5-a4b4-4288-a6b2-dce952e80a7f
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
|
|
dn: CN=Manage-Optional-Features,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Manage Optional Features
|
|
rightsGuid: 7c0e2a7c-a419-48e4-a995-10180aad54dd
|
|
appliesTo: ef9e60e0-56f7-11d1-a9c6-0000f80367c1
|
|
validAccesses: 256
|
|
|
|
dn: CN=Read-Only-Replication-Secret-Synchronization,CN=Extended-Rights,${CONFIGDN}
|
|
objectClass: top
|
|
objectClass: controlAccessRight
|
|
displayName: Read Only Replication Secret Synchronization
|
|
rightsGuid: 1131f6ae-9c07-11d1-f79f-00c04fc2dcd2
|
|
appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
|
|
appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
validAccesses: 256
|
|
${INC2012}
|
|
${INC2012}dn: CN=Validated-MS-DS-Behavior-Version,CN=Extended-Rights,${CONFIGDN}
|
|
${INC2012}objectClass: controlAccessRight
|
|
${INC2012}rightsGuid: d31a8757-2447-4545-8081-3bb610cacbf2
|
|
${INC2012}appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
|
|
${INC2012}displayName: Validated write to MS DS behavior version
|
|
${INC2012}localizationDisplayId: 81
|
|
${INC2012}validAccesses: 8
|
|
${INC2012}showInAdvancedViewOnly: TRUE
|
|
${INC2012}
|
|
${INC2012}dn: CN=Validated-MS-DS-Additional-DNS-Host-Name,CN=Extended-Rights,${CONFIGDN}
|
|
${INC2012}objectClass: controlAccessRight
|
|
${INC2012}rightsGuid: 80863791-dbe9-4eb8-837e-7f0ab55d9ac7
|
|
${INC2012}appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
|
|
${INC2012}displayName: Validated write to MS DS Additional DNS Host Name
|
|
${INC2012}localizationDisplayId: 82
|
|
${INC2012}validAccesses: 8
|
|
${INC2012}showInAdvancedViewOnly: TRUE
|
|
${INC2012}
|
|
${INC2012}dn: CN=DS-Clone-Domain-Controller,CN=Extended-Rights,${CONFIGDN}
|
|
${INC2012}objectClass: controlAccessRight
|
|
${INC2012}displayName: Allow a DC to create a clone of itself
|
|
${INC2012}rightsGuid: 3e0f7e18-2c7a-4c10-ba82-4d926db99a3e
|
|
${INC2012}appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
|
|
${INC2012}validAccesses: 256
|
|
${INC2012}localizationDisplayId: 80
|
|
${INC2012}
|
|
${INC2012}dn: CN=Certificate-AutoEnrollment,CN=Extended-Rights,${CONFIGDN}
|
|
${INC2012}objectClass: controlAccessRight
|
|
${INC2012}showInAdvancedViewOnly: TRUE
|
|
${INC2012}appliesTo: e5209ca2-3bba-11d2-90cc-00c04fd91ab1
|
|
${INC2012}displayname: AutoEnrollment
|
|
${INC2012}localizationDisplayId: 83
|
|
${INC2012}rightsGuid: a05b8cc2-17bc-4802-a710-e7c15ab866a2
|
|
${INC2012}validAccesses: 256
|
|
${INC2012}
|
|
${INC2012}dn: CN=DS-Set-Owner,CN=Extended-Rights,${CONFIGDN}
|
|
${INC2012}objectClass: controlAccessRight
|
|
${INC2012}displayName: Set Owner of an object during creation.
|
|
${INC2012}rightsGuid: 4125c71f-7fac-4ff0-bcb7-f09a41325286
|
|
${INC2012}appliesTo: 26f11b08-a29d-4869-99bb-ef0b99fd883e
|
|
${INC2012}validAccesses: 256
|
|
${INC2012}
|
|
${INC2012}dn: CN=DS-Bypass-Quota,CN=Extended-Rights,${CONFIGDN}
|
|
${INC2012}objectClass: controlAccessRight
|
|
${INC2012}displayName: Bypass the quota restrictions during creation.
|
|
${INC2012}rightsGuid: 88a9933e-e5c8-4f2a-9dd7-2527416b8092
|
|
${INC2012}appliesTo: 26f11b08-a29d-4869-99bb-ef0b99fd883e
|
|
${INC2012}validAccesses: 256
|
|
${INC2012}
|
|
${INC2012}dn: CN=DS-Read-Partition-Secrets,CN=Extended-Rights,${CONFIGDN}
|
|
${INC2012}objectClass: controlAccessRight
|
|
${INC2012}displayName: Read secret attributes of objects in a Partition
|
|
${INC2012}rightsGuid: 084c93a2-620d-4879-a836-f0ae47de0e89
|
|
${INC2012}appliesTo: 26f11b08-a29d-4869-99bb-ef0b99fd883e
|
|
${INC2012}validAccesses: 256
|
|
${INC2012}
|
|
${INC2012}dn: CN=DS-Write-Partition-Secrets,CN=Extended-Rights,${CONFIGDN}
|
|
${INC2012}objectClass: controlAccessRight
|
|
${INC2012}displayName: Write secret attributes of objects in a Partition
|
|
${INC2012}rightsGuid: 94825A8D-B171-4116-8146-1E34D8F54401
|
|
${INC2012}appliesTo: 26f11b08-a29d-4869-99bb-ef0b99fd883e
|
|
${INC2012}validAccesses: 256
|
|
|