source4/setup/provision_users.ldif

   1 # Add default primary groups (domain users, domain guests, domain computers &
   2 # domain controllers) - needed for the users to find valid primary groups
   3 # (samldb module)
   4
   5 dn: CN=Domain Users,CN=Users,${DOMAINDN}
   6 objectClass: top
   7 objectClass: group
   8 description: All domain users
   9 objectSid: ${DOMAINSID}-513
  10 sAMAccountName: Domain Users
  11 isCriticalSystemObject: TRUE
  12
  13 dn: CN=Domain Guests,CN=Users,${DOMAINDN}
  14 objectClass: top
  15 objectClass: group
  16 description: All domain guests
  17 objectSid: ${DOMAINSID}-514
  18 sAMAccountName: Domain Guests
  19 isCriticalSystemObject: TRUE
  20
  21 dn: CN=Domain Computers,CN=Users,${DOMAINDN}
  22 objectClass: top
  23 objectClass: group
  24 description: All workstations and servers joined to the domain
  25 objectSid: ${DOMAINSID}-515
  26 sAMAccountName: Domain Computers
  27 isCriticalSystemObject: TRUE
  28
  29 dn: CN=Domain Controllers,CN=Users,${DOMAINDN}
  30 objectClass: top
  31 objectClass: group
  32 description: All domain controllers in the domain
  33 objectSid: ${DOMAINSID}-516
  34 adminCount: 1
  35 sAMAccountName: Domain Controllers
  36 isCriticalSystemObject: TRUE
  37
  38 # Add users
  39
  40 dn: CN=Administrator,CN=Users,${DOMAINDN}
  41 objectClass: user
  42 description: Built-in account for administering the computer/domain
  43 userAccountControl: 512
  44 objectSid: ${DOMAINSID}-500
  45 adminCount: 1
  46 accountExpires: 9223372036854775807
  47 sAMAccountName: Administrator
  48 clearTextPassword:: ${ADMINPASS_B64}
  49 isCriticalSystemObject: TRUE
  50
  51 dn: CN=Guest,CN=Users,${DOMAINDN}
  52 objectClass: user
  53 description: Built-in account for guest access to the computer/domain
  54 userAccountControl: 66082
  55 primaryGroupID: 514
  56 objectSid: ${DOMAINSID}-501
  57 sAMAccountName: Guest
  58 isCriticalSystemObject: TRUE
  59
  60 dn: CN=krbtgt,CN=Users,${DOMAINDN}
  61 objectClass: top
  62 objectClass: person
  63 objectClass: organizationalPerson
  64 objectClass: user
  65 description: Key Distribution Center Service Account
  66 showInAdvancedViewOnly: TRUE
  67 userAccountControl: 514
  68 objectSid: ${DOMAINSID}-502
  69 adminCount: 1
  70 accountExpires: 9223372036854775807
  71 sAMAccountName: krbtgt
  72 servicePrincipalName: kadmin/changepw
  73 clearTextPassword:: ${KRBTGTPASS_B64}
  74 isCriticalSystemObject: TRUE
  75
  76 # Add other groups
  77
  78 dn: CN=Enterprise Read-only Domain Controllers,CN=Users,${DOMAINDN}
  79 objectClass: top
  80 objectClass: group
  81 description: Members of this group are Read-Only Domain Controllers in the enterprise
  82 objectSid: ${DOMAINSID}-498
  83 sAMAccountName: Enterprise Read-Only Domain Controllers
  84 groupType: -2147483640
  85 isCriticalSystemObject: TRUE
  86
  87 dn: CN=Domain Admins,CN=Users,${DOMAINDN}
  88 objectClass: top
  89 objectClass: group
  90 description: Designated administrators of the domain
  91 member: CN=Administrator,CN=Users,${DOMAINDN}
  92 objectSid: ${DOMAINSID}-512
  93 adminCount: 1
  94 sAMAccountName: Domain Admins
  95 isCriticalSystemObject: TRUE
  96
  97 dn: CN=Cert Publishers,CN=Users,${DOMAINDN}
  98 objectClass: top
  99 objectClass: group
 100 description: Members of this group are permitted to publish certificates to the directory
 101 objectSid: ${DOMAINSID}-517
 102 sAMAccountName: Cert Publishers
 103 groupType: -2147483644
 104 isCriticalSystemObject: TRUE
 105
 106 dn: CN=Schema Admins,CN=Users,${DOMAINDN}
 107 objectClass: top
 108 objectClass: group
 109 description: Designated administrators of the schema
 110 member: CN=Administrator,CN=Users,${DOMAINDN}
 111 objectSid: ${DOMAINSID}-518
 112 adminCount: 1
 113 sAMAccountName: Schema Admins
 114 groupType: -2147483640
 115 isCriticalSystemObject: TRUE
 116
 117 dn: CN=Enterprise Admins,CN=Users,${DOMAINDN}
 118 objectClass: top
 119 objectClass: group
 120 description: Designated administrators of the enterprise
 121 member: CN=Administrator,CN=Users,${DOMAINDN}
 122 objectSid: ${DOMAINSID}-519
 123 adminCount: 1
 124 sAMAccountName: Enterprise Admins
 125 groupType: -2147483640
 126 isCriticalSystemObject: TRUE
 127
 128 dn: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
 129 objectClass: top
 130 objectClass: group
 131 description: Members in this group can modify group policy for the domain
 132 member: CN=Administrator,CN=Users,${DOMAINDN}
 133 objectSid: ${DOMAINSID}-520
 134 sAMAccountName: Group Policy Creator Owners
 135 isCriticalSystemObject: TRUE
 136
 137 dn: CN=Read-only Domain Controllers,CN=Users,${DOMAINDN}
 138 objectClass: top
 139 objectClass: group
 140 description: Members of this group are Read-Only Domain Controllers in the domain
 141 objectSid: ${DOMAINSID}-521
 142 adminCount: 1
 143 sAMAccountName: Read-Only Domain Controllers
 144 isCriticalSystemObject: TRUE
 145
 146 dn: CN=RAS and IAS Servers,CN=Users,${DOMAINDN}
 147 objectClass: top
 148 objectClass: group
 149 description: Servers in this group can access remote access properties of users
 150 objectSid: ${DOMAINSID}-553
 151 sAMAccountName: RAS and IAS Servers
 152 groupType: -2147483644
 153 isCriticalSystemObject: TRUE
 154
 155 dn: CN=Allowed RODC Password Replication Group,CN=Users,${DOMAINDN}
 156 objectClass: top
 157 objectClass: group
 158 description: Members in this group can have their passwords replicated to all read-only domain controllers in the domain
 159 objectSid: ${DOMAINSID}-571
 160 sAMAccountName: Allowed RODC Password Replication Group
 161 groupType: -2147483644
 162 isCriticalSystemObject: TRUE
 163
 164 dn: CN=Denied RODC Password Replication Group,CN=Users,${DOMAINDN}
 165 objectClass: top
 166 objectClass: group
 167 description: Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain
 168 member: CN=Read-only Domain Controllers,CN=Users,${DOMAINDN}
 169 member: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
 170 member: CN=Domain Admins,CN=Users,${DOMAINDN}
 171 member: CN=Cert Publishers,CN=Users,${DOMAINDN}
 172 member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
 173 member: CN=Schema Admins,CN=Users,${DOMAINDN}
 174 member: CN=Domain Controllers,CN=Users,${DOMAINDN}
 175 member: CN=krbtgt,CN=Users,${DOMAINDN}
 176 objectSid: ${DOMAINSID}-572
 177 sAMAccountName: Denied RODC Password Replication Group
 178 groupType: -2147483644
 179 isCriticalSystemObject: TRUE
 180
 181 # NOTICE: Some other users and groups which rely on automatic SIDs are located
 182 # in "provision_self_join_modify.ldif"
 183
 184 # Add foreign security principals
 185
 186 dn: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
 187 objectClass: top
 188 objectClass: foreignSecurityPrincipal
 189 objectSid: S-1-5-4
 190
 191 dn: CN=S-1-5-9,CN=ForeignSecurityPrincipals,${DOMAINDN}
 192 objectClass: top
 193 objectClass: foreignSecurityPrincipal
 194 objectSid: S-1-5-9
 195
 196 dn: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
 197 objectClass: top
 198 objectClass: foreignSecurityPrincipal
 199 objectSid: S-1-5-11
 200
 201 dn: CN=S-1-5-17,CN=ForeignSecurityPrincipals,${DOMAINDN}
 202 objectClass: top
 203 objectClass: foreignSecurityPrincipal
 204 objectSid: S-1-5-17
 205
 206 # Add builtin objects
 207
 208 dn: CN=Administrators,CN=Builtin,${DOMAINDN}
 209 objectClass: top
 210 objectClass: group
 211 description: Administrators have complete and unrestricted access to the computer/domain
 212 member: CN=Domain Admins,CN=Users,${DOMAINDN}
 213 member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
 214 member: CN=Administrator,CN=Users,${DOMAINDN}
 215 objectSid: S-1-5-32-544
 216 adminCount: 1
 217 sAMAccountName: Administrators
 218 systemFlags: -1946157056
 219 groupType: -2147483643
 220 isCriticalSystemObject: TRUE
 221
 222 dn: CN=Users,CN=Builtin,${DOMAINDN}
 223 objectClass: top
 224 objectClass: group
 225 description: Users are prevented from making accidental or intentional system-wide changes and can run most applications
 226 member: CN=Domain Users,CN=Users,${DOMAINDN}
 227 member: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
 228 member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
 229 objectSid: S-1-5-32-545
 230 sAMAccountName: Users
 231 systemFlags: -1946157056
 232 groupType: -2147483643
 233 isCriticalSystemObject: TRUE
 234
 235 dn: CN=Guests,CN=Builtin,${DOMAINDN}
 236 objectClass: top
 237 objectClass: group
 238 description: Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted
 239 member: CN=Domain Guests,CN=Users,${DOMAINDN}
 240 member: CN=Guest,CN=Users,${DOMAINDN}
 241 objectSid: S-1-5-32-546
 242 sAMAccountName: Guests
 243 systemFlags: -1946157056
 244 groupType: -2147483643
 245 isCriticalSystemObject: TRUE
 246
 247 dn: CN=Account Operators,CN=Builtin,${DOMAINDN}
 248 objectClass: top
 249 objectClass: group
 250 description: Members can administer domain user and group accounts
 251 objectSid: S-1-5-32-548
 252 adminCount: 1
 253 sAMAccountName: Account Operators
 254 systemFlags: -1946157056
 255 groupType: -2147483643
 256 isCriticalSystemObject: TRUE
 257
 258 dn: CN=Server Operators,CN=Builtin,${DOMAINDN}
 259 objectClass: top
 260 objectClass: group
 261 description: Members can administer domain servers
 262 objectSid: S-1-5-32-549
 263 adminCount: 1
 264 sAMAccountName: Server Operators
 265 systemFlags: -1946157056
 266 groupType: -2147483643
 267 isCriticalSystemObject: TRUE
 268
 269 dn: CN=Print Operators,CN=Builtin,${DOMAINDN}
 270 objectClass: top
 271 objectClass: group
 272 description: Members can administer domain printers
 273 objectSid: S-1-5-32-550
 274 adminCount: 1
 275 sAMAccountName: Print Operators
 276 systemFlags: -1946157056
 277 groupType: -2147483643
 278 isCriticalSystemObject: TRUE
 279
 280 dn: CN=Backup Operators,CN=Builtin,${DOMAINDN}
 281 objectClass: top
 282 objectClass: group
 283 description: Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
 284 objectSid: S-1-5-32-551
 285 adminCount: 1
 286 sAMAccountName: Backup Operators
 287 systemFlags: -1946157056
 288 groupType: -2147483643
 289 isCriticalSystemObject: TRUE
 290
 291 dn: CN=Replicator,CN=Builtin,${DOMAINDN}
 292 objectClass: top
 293 objectClass: group
 294 description: Supports file replication in a domain
 295 objectSid: S-1-5-32-552
 296 adminCount: 1
 297 sAMAccountName: Replicator
 298 systemFlags: -1946157056
 299 groupType: -2147483643
 300 isCriticalSystemObject: TRUE
 301
 302 dn: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,${DOMAINDN}
 303 objectClass: top
 304 objectClass: group
 305 description: A backward compatibility group which allows read access on all users and groups in the domain
 306 member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
 307 objectSid: S-1-5-32-554
 308 sAMAccountName: Pre-Windows 2000 Compatible Access
 309 systemFlags: -1946157056
 310 groupType: -2147483643
 311 isCriticalSystemObject: TRUE
 312
 313 dn: CN=Remote Desktop Users,CN=Builtin,${DOMAINDN}
 314 objectClass: top
 315 objectClass: group
 316 description: Members in this group are granted the right to logon remotely
 317 objectSid: S-1-5-32-555
 318 sAMAccountName: Remote Desktop Users
 319 systemFlags: -1946157056
 320 groupType: -2147483643
 321 isCriticalSystemObject: TRUE
 322
 323 dn: CN=Network Configuration Operators,CN=Builtin,${DOMAINDN}
 324 objectClass: top
 325 objectClass: group
 326 description: Members in this group can have some administrative privileges to manage configuration of networking features
 327 objectSid: S-1-5-32-556
 328 sAMAccountName: Network Configuration Operators
 329 systemFlags: -1946157056
 330 groupType: -2147483643
 331 isCriticalSystemObject: TRUE
 332
 333 dn: CN=Incoming Forest Trust Builders,CN=Builtin,${DOMAINDN}
 334 objectClass: top
 335 objectClass: group
 336 description: Members of this group can create incoming, one-way trusts to this forest
 337 objectSid: S-1-5-32-557
 338 sAMAccountName: Incoming Forest Trust Builders
 339 systemFlags: -1946157056
 340 groupType: -2147483643
 341 isCriticalSystemObject: TRUE
 342
 343 dn: CN=Performance Monitor Users,CN=Builtin,${DOMAINDN}
 344 objectClass: top
 345 objectClass: group
 346 description: Members of this group can access performance counter data locally and remotely
 347 objectSid: S-1-5-32-558
 348 sAMAccountName: Performance Monitor Users
 349 systemFlags: -1946157056
 350 groupType: -2147483643
 351 isCriticalSystemObject: TRUE
 352
 353 dn: CN=Performance Log Users,CN=Builtin,${DOMAINDN}
 354 objectClass: top
 355 objectClass: group
 356 description: Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer
 357 objectSid: S-1-5-32-559
 358 sAMAccountName: Performance Log Users
 359 systemFlags: -1946157056
 360 groupType: -2147483643
 361 isCriticalSystemObject: TRUE
 362
 363 dn: CN=Windows Authorization Access Group,CN=Builtin,${DOMAINDN}
 364 objectClass: top
 365 objectClass: group
 366 description: Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects
 367 member: CN=S-1-5-9,CN=ForeignSecurityPrincipals,${DOMAINDN}
 368 objectSid: S-1-5-32-560
 369 sAMAccountName: Windows Authorization Access Group
 370 systemFlags: -1946157056
 371 groupType: -2147483643
 372 isCriticalSystemObject: TRUE
 373
 374 dn: CN=Terminal Server License Servers,CN=Builtin,${DOMAINDN}
 375 objectClass: top
 376 objectClass: group
 377 description: Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage
 378 objectSid: S-1-5-32-561
 379 sAMAccountName: Terminal Server License Servers
 380 systemFlags: -1946157056
 381 groupType: -2147483643
 382 isCriticalSystemObject: TRUE
 383
 384 dn: CN=Distributed COM Users,CN=Builtin,${DOMAINDN}
 385 objectClass: top
 386 objectClass: group
 387 description: Members are allowed to launch, activate and use Distributed COM objects on this machine.
 388 objectSid: S-1-5-32-562
 389 sAMAccountName: Distributed COM Users
 390 systemFlags: -1946157056
 391 groupType: -2147483643
 392 isCriticalSystemObject: TRUE
 393
 394 dn: CN=IIS_IUSRS,CN=Builtin,${DOMAINDN}
 395 objectClass: top
 396 objectClass: group
 397 description: Built-in group used by Internet Information Services.
 398 member: CN=S-1-5-17,CN=ForeignSecurityPrincipals,${DOMAINDN}
 399 objectSid: S-1-5-32-568
 400 sAMAccountName: IIS_IUSRS
 401 systemFlags: -1946157056
 402 groupType: -2147483643
 403 isCriticalSystemObject: TRUE
 404
 405 dn: CN=Cryptographic Operators,CN=Builtin,${DOMAINDN}
 406 objectClass: top
 407 objectClass: group
 408 description: Members are authorized to perform cryptographic operations.
 409 objectSid: S-1-5-32-569
 410 sAMAccountName: Cryptographic Operators
 411 systemFlags: -1946157056
 412 groupType: -2147483643
 413 isCriticalSystemObject: TRUE
 414
 415 dn: CN=Event Log Readers,CN=Builtin,${DOMAINDN}
 416 objectClass: top
 417 objectClass: group
 418 description: Members of this group can read event logs from local machine
 419 objectSid: S-1-5-32-573
 420 sAMAccountName: Event Log Readers
 421 systemFlags: -1946157056
 422 groupType: -2147483643
 423 isCriticalSystemObject: TRUE
 424
 425 dn: CN=Certificate Service DCOM Access,CN=Builtin,${DOMAINDN}
 426 objectClass: top
 427 objectClass: group
 428 description: Members of this group are allowed to connect to Certification Authorities in the enterprise
 429 objectSid: S-1-5-32-574
 430 sAMAccountName: Certificate Service DCOM Access
 431 systemFlags: -1946157056
 432 groupType: -2147483643
 433 isCriticalSystemObject: TRUE
 434
 435 # Add well known security principals
 436
 437 dn: CN=WellKnown Security Principals,${CONFIGDN}
 438 objectClass: top
 439 objectClass: container
 440 systemFlags: -2147483648
 441
 442 dn: CN=Anonymous Logon,CN=WellKnown Security Principals,${CONFIGDN}
 443 objectClass: top
 444 objectClass: foreignSecurityPrincipal
 445 objectSid: S-1-5-7
 446
 447 dn: CN=Authenticated Users,CN=WellKnown Security Principals,${CONFIGDN}
 448 objectClass: top
 449 objectClass: foreignSecurityPrincipal
 450 objectSid: S-1-5-11
 451
 452 dn: CN=Batch,CN=WellKnown Security Principals,${CONFIGDN}
 453 objectClass: top
 454 objectClass: foreignSecurityPrincipal
 455 objectSid: S-1-5-3
 456
 457 dn: CN=Creator Group,CN=WellKnown Security Principals,${CONFIGDN}
 458 objectClass: top
 459 objectClass: foreignSecurityPrincipal
 460 objectSid: S-1-3-1
 461
 462 dn: CN=Creator Owner,CN=WellKnown Security Principals,${CONFIGDN}
 463 objectClass: top
 464 objectClass: foreignSecurityPrincipal
 465 objectSid: S-1-3-0
 466
 467 dn: CN=Dialup,CN=WellKnown Security Principals,${CONFIGDN}
 468 objectClass: top
 469 objectClass: foreignSecurityPrincipal
 470 objectSid: S-1-5-1
 471
 472 dn: CN=Digest Authentication,CN=WellKnown Security Principals,${CONFIGDN}
 473 objectClass: top
 474 objectClass: foreignSecurityPrincipal
 475 objectSid: S-1-5-64-21
 476
 477 dn: CN=Enterprise Domain Controllers,CN=WellKnown Security Principals,${CONFIGDN}
 478 objectClass: top
 479 objectClass: foreignSecurityPrincipal
 480 objectSid: S-1-5-9
 481
 482 dn: CN=Everyone,CN=WellKnown Security Principals,${CONFIGDN}
 483 objectClass: top
 484 objectClass: foreignSecurityPrincipal
 485 objectSid: S-1-1-0
 486
 487 dn: CN=Interactive,CN=WellKnown Security Principals,${CONFIGDN}
 488 objectClass: top
 489 objectClass: foreignSecurityPrincipal
 490 objectSid: S-1-5-4
 491
 492 dn: CN=IUSR,CN=WellKnown Security Principals,${CONFIGDN}
 493 objectClass: top
 494 objectClass: foreignSecurityPrincipal
 495 objectSid: S-1-5-17
 496
 497 dn: CN=Local Service,CN=WellKnown Security Principals,${CONFIGDN}
 498 objectClass: top
 499 objectClass: foreignSecurityPrincipal
 500 objectSid: S-1-5-19
 501
 502 dn: CN=Network,CN=WellKnown Security Principals,${CONFIGDN}
 503 objectClass: top
 504 objectClass: foreignSecurityPrincipal
 505 objectSid: S-1-5-2
 506
 507 dn: CN=Network Service,CN=WellKnown Security Principals,${CONFIGDN}
 508 objectClass: top
 509 objectClass: foreignSecurityPrincipal
 510 objectSid: S-1-5-20
 511
 512 dn: CN=NTLM Authentication,CN=WellKnown Security Principals,${CONFIGDN}
 513 objectClass: top
 514 objectClass: foreignSecurityPrincipal
 515 objectSid: S-1-5-64-10
 516
 517 dn: CN=Other Organization,CN=WellKnown Security Principals,${CONFIGDN}
 518 objectClass: top
 519 objectClass: foreignSecurityPrincipal
 520 objectSid: S-1-5-1000
 521
 522 dn: CN=Owner Rights,CN=WellKnown Security Principals,${CONFIGDN}
 523 objectClass: top
 524 objectClass: foreignSecurityPrincipal
 525 objectSid: S-1-3-4
 526
 527 dn: CN=Proxy,CN=WellKnown Security Principals,${CONFIGDN}
 528 objectClass: top
 529 objectClass: foreignSecurityPrincipal
 530 objectSid: S-1-5-8
 531
 532 dn: CN=Remote Interactive Logon,CN=WellKnown Security Principals,${CONFIGDN}
 533 objectClass: top
 534 objectClass: foreignSecurityPrincipal
 535 objectSid: S-1-5-14
 536
 537 dn: CN=Restricted,CN=WellKnown Security Principals,${CONFIGDN}
 538 objectClass: top
 539 objectClass: foreignSecurityPrincipal
 540 objectSid: S-1-5-12
 541
 542 dn: CN=SChannel Authentication,CN=WellKnown Security Principals,${CONFIGDN}
 543 objectClass: top
 544 objectClass: foreignSecurityPrincipal
 545 objectSid: S-1-5-64-14
 546
 547 dn: CN=Self,CN=WellKnown Security Principals,${CONFIGDN}
 548 objectClass: top
 549 objectClass: foreignSecurityPrincipal
 550 objectSid: S-1-5-10
 551
 552 dn: CN=Service,CN=WellKnown Security Principals,${CONFIGDN}
 553 objectClass: top
 554 objectClass: foreignSecurityPrincipal
 555 objectSid: S-1-5-6
 556
 557 dn: CN=System,CN=WellKnown Security Principals,${CONFIGDN}
 558 objectClass: top
 559 objectClass: foreignSecurityPrincipal
 560 objectSid: S-1-5-18
 561
 562 dn: CN=Terminal Server User,CN=WellKnown Security Principals,${CONFIGDN}
 563 objectClass: top
 564 objectClass: foreignSecurityPrincipal
 565 objectSid: S-1-5-13
 566
 567 dn: CN=This Organization,CN=WellKnown Security Principals,${CONFIGDN}
 568 objectClass: top
 569 objectClass: foreignSecurityPrincipal
 570 objectSid: S-1-5-15