1 # Add default primary groups (domain users, domain guests, domain computers &
2 # domain controllers) - needed for the users to find valid primary groups
5 dn: CN=Domain Users
,CN=Users
,$
{DOMAINDN
}
8 description: All domain users
9 objectSid
: $
{DOMAINSID
}-513
10 sAMAccountName
: Domain Users
11 isCriticalSystemObject
: TRUE
13 dn: CN=Domain Guests
,CN=Users
,$
{DOMAINDN
}
16 description: All domain guests
17 objectSid
: $
{DOMAINSID
}-514
18 sAMAccountName
: Domain Guests
19 isCriticalSystemObject
: TRUE
21 dn: CN=Domain Computers
,CN=Users
,$
{DOMAINDN
}
24 description: All workstations and servers joined to the domain
25 objectSid
: $
{DOMAINSID
}-515
26 sAMAccountName
: Domain Computers
27 isCriticalSystemObject
: TRUE
29 dn: CN=Domain Controllers
,CN=Users
,$
{DOMAINDN
}
32 description: All domain controllers in the domain
33 objectSid
: $
{DOMAINSID
}-516
35 sAMAccountName
: Domain Controllers
36 isCriticalSystemObject
: TRUE
40 dn: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
42 description: Built
-in account for administering the computer
/domain
43 userAccountControl
: 66048
44 objectSid
: $
{DOMAINSID
}-500
46 accountExpires
: 9223372036854775807
47 sAMAccountName
: Administrator
48 userPassword:: $
{ADMINPASS_B64
}
49 isCriticalSystemObject
: TRUE
51 dn: CN=Guest
,CN=Users
,$
{DOMAINDN
}
53 description: Built
-in account for guest access to the computer
/domain
54 userAccountControl
: 66082
56 objectSid
: $
{DOMAINSID
}-501
58 isCriticalSystemObject
: TRUE
60 dn: CN=krbtgt
,CN=Users
,$
{DOMAINDN
}
63 objectClass: organizationalPerson
65 description: Key Distribution Center Service Account
66 showInAdvancedViewOnly
: TRUE
67 userAccountControl
: 514
68 objectSid
: $
{DOMAINSID
}-502
70 accountExpires
: 9223372036854775807
71 sAMAccountName
: krbtgt
72 servicePrincipalName
: kadmin
/changepw
73 userPassword:: $
{KRBTGTPASS_B64
}
74 isCriticalSystemObject
: TRUE
78 dn: CN=Enterprise Read
-Only Domain Controllers
,CN=Users
,$
{DOMAINDN
}
81 description: Members of this group are Read
-Only Domain Controllers in the enterprise
82 objectSid
: $
{DOMAINSID
}-498
83 sAMAccountName
: Enterprise Read
-Only Domain Controllers
84 groupType
: -2147483640
85 isCriticalSystemObject
: TRUE
87 dn: CN=Domain Admins
,CN=Users
,$
{DOMAINDN
}
90 description: Designated administrators of the domain
91 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
92 objectSid
: $
{DOMAINSID
}-512
94 sAMAccountName
: Domain Admins
95 isCriticalSystemObject
: TRUE
97 dn: CN=Cert Publishers
,CN=Users
,$
{DOMAINDN
}
100 description: Members of this group are permitted to publish certificates to the Active Directory
101 objectSid
: $
{DOMAINSID
}-517
102 sAMAccountName
: Cert Publishers
103 groupType
: -2147483644
104 isCriticalSystemObject
: TRUE
106 dn: CN=Schema Admins
,CN=Users
,$
{DOMAINDN
}
109 description: Designated administrators of the schema
110 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
111 objectSid
: $
{DOMAINSID
}-518
113 sAMAccountName
: Schema Admins
114 groupType
: -2147483640
115 isCriticalSystemObject
: TRUE
117 dn: CN=Enterprise Admins
,CN=Users
,$
{DOMAINDN
}
120 description: Designated administrators of the enterprise
121 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
122 objectSid
: $
{DOMAINSID
}-519
124 sAMAccountName
: Enterprise Admins
125 groupType
: -2147483640
126 isCriticalSystemObject
: TRUE
128 dn: CN=Group Policy Creator Owners
,CN=Users
,$
{DOMAINDN
}
131 description: Members in this group can
modify group policies for the domain
132 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
133 objectSid
: $
{DOMAINSID
}-520
134 sAMAccountName
: Group Policy Creator Owners
135 isCriticalSystemObject
: TRUE
137 dn: CN=Read
-Only Domain Controllers
,CN=Users
,$
{DOMAINDN
}
140 description: Members of this group are Read
-Only Domain Controllers in the domain
141 objectSid
: $
{DOMAINSID
}-521
143 sAMAccountName
: Read
-Only Domain Controllers
144 isCriticalSystemObject
: TRUE
146 dn: CN=RAS and IAS Servers
,CN=Users
,$
{DOMAINDN
}
149 description: Servers in this group can access remote access properties of users
150 objectSid
: $
{DOMAINSID
}-553
151 sAMAccountName
: RAS and IAS Servers
152 groupType
: -2147483644
153 isCriticalSystemObject
: TRUE
155 dn: CN=Allowed RODC Password Replication Group
,CN=Users
,$
{DOMAINDN
}
158 description: Members in this group can have their passwords replicated to all read
-only domain controllers in the domain.
159 objectSid
: $
{DOMAINSID
}-571
160 sAMAccountName
: Allowed RODC Password Replication Group
161 groupType
: -2147483644
162 isCriticalSystemObject
: TRUE
164 dn: CN=Denied RODC Password Replication Group
,CN=Users
,$
{DOMAINDN
}
167 description: Members in this group cannot have their passwords replicated to any read
-only domain controllers in the domain.
168 member
: CN=Read
-Only Domain Controllers
,CN=Users
,$
{DOMAINDN
}
169 member
: CN=Group Policy Creator Owners
,CN=Users
,$
{DOMAINDN
}
170 member
: CN=Domain Admins
,CN=Users
,$
{DOMAINDN
}
171 member
: CN=Cert Publishers
,CN=Users
,$
{DOMAINDN
}
172 member
: CN=Enterprise Admins
,CN=Users
,$
{DOMAINDN
}
173 member
: CN=Schema Admins
,CN=Users
,$
{DOMAINDN
}
174 member
: CN=Domain Controllers
,CN=Users
,$
{DOMAINDN
}
175 member
: CN=krbtgt
,CN=Users
,$
{DOMAINDN
}
176 objectSid
: $
{DOMAINSID
}-572
177 sAMAccountName
: Denied RODC Password Replication Group
178 groupType
: -2147483644
179 isCriticalSystemObject
: TRUE
181 # Add foreign security principals
183 dn: CN=S
-1-5-4,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
185 objectClass: foreignSecurityPrincipal
188 dn: CN=S
-1-5-9,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
190 objectClass: foreignSecurityPrincipal
193 dn: CN=S
-1-5-11,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
195 objectClass: foreignSecurityPrincipal
198 dn: CN=S
-1-5-17,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
200 objectClass: foreignSecurityPrincipal
203 dn: CN=S
-1-5-20,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
205 objectClass: foreignSecurityPrincipal
208 # Add builtin objects
210 dn: CN=Administrators
,CN=Builtin
,$
{DOMAINDN
}
213 description: Administrators have complete and unrestricted access to the computer
/domain
214 member
: CN=Domain Admins
,CN=Users
,$
{DOMAINDN
}
215 member
: CN=Enterprise Admins
,CN=Users
,$
{DOMAINDN
}
216 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
217 objectSid
: S
-1-5-32-544
219 sAMAccountName
: Administrators
220 systemFlags
: -1946157056
221 groupType
: -2147483643
222 isCriticalSystemObject
: TRUE
224 dn: CN=Users
,CN=Builtin
,$
{DOMAINDN
}
227 description: Users are prevented from making accidental or intentional system
-wide changes. Thus
, Users can run certified applications
, but not most legacy applications
228 member
: CN=Domain Users
,CN=Users
,$
{DOMAINDN
}
229 member
: CN=S
-1-5-4,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
230 member
: CN=S
-1-5-11,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
231 objectSid
: S
-1-5-32-545
232 sAMAccountName
: Users
233 systemFlags
: -1946157056
234 groupType
: -2147483643
235 isCriticalSystemObject
: TRUE
237 dn: CN=Guests
,CN=Builtin
,$
{DOMAINDN
}
240 description: Guests have the same access as members of the Users group by default
, except for the Guest account which is further restricted
241 member
: CN=Domain Guests
,CN=Users
,$
{DOMAINDN
}
242 member
: CN=Guest
,CN=Users
,$
{DOMAINDN
}
243 objectSid
: S
-1-5-32-546
244 sAMAccountName
: Guests
245 systemFlags
: -1946157056
246 groupType
: -2147483643
247 isCriticalSystemObject
: TRUE
249 dn: CN=Account Operators
,CN=Builtin
,$
{DOMAINDN
}
252 description: Members can administer domain user and group accounts
253 objectSid
: S
-1-5-32-548
255 sAMAccountName
: Account Operators
256 systemFlags
: -1946157056
257 groupType
: -2147483643
258 isCriticalSystemObject
: TRUE
260 dn: CN=Server Operators
,CN=Builtin
,$
{DOMAINDN
}
263 description: Members can administer domain servers
264 objectSid
: S
-1-5-32-549
266 sAMAccountName
: Server Operators
267 systemFlags
: -1946157056
268 groupType
: -2147483643
269 isCriticalSystemObject
: TRUE
271 dn: CN=Print Operators
,CN=Builtin
,$
{DOMAINDN
}
274 description: Members can administer domain printers
275 objectSid
: S
-1-5-32-550
277 sAMAccountName
: Print Operators
278 systemFlags
: -1946157056
279 groupType
: -2147483643
280 isCriticalSystemObject
: TRUE
282 dn: CN=Backup Operators
,CN=Builtin
,$
{DOMAINDN
}
285 description: Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
286 objectSid
: S
-1-5-32-551
288 sAMAccountName
: Backup Operators
289 systemFlags
: -1946157056
290 groupType
: -2147483643
291 isCriticalSystemObject
: TRUE
293 dn: CN=Replicator
,CN=Builtin
,$
{DOMAINDN
}
296 description: Supports file replication in a domain
297 objectSid
: S
-1-5-32-552
299 sAMAccountName
: Replicator
300 systemFlags
: -1946157056
301 groupType
: -2147483643
302 isCriticalSystemObject
: TRUE
304 dn: CN=Pre
-Windows
2000 Compatible Access
,CN=Builtin
,$
{DOMAINDN
}
307 description: A backward compatibility group which allows read access on all users and groups in the domain
308 member
: CN=S
-1-5-11,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
309 objectSid
: S
-1-5-32-554
310 sAMAccountName
: Pre
-Windows
2000 Compatible Access
311 systemFlags
: -1946157056
312 groupType
: -2147483643
313 isCriticalSystemObject
: TRUE
315 dn: CN=Remote Desktop Users
,CN=Builtin
,$
{DOMAINDN
}
318 description: Members in this group are granted the right to logon remotely
319 objectSid
: S
-1-5-32-555
320 sAMAccountName
: Remote Desktop Users
321 systemFlags
: -1946157056
322 groupType
: -2147483643
323 isCriticalSystemObject
: TRUE
325 dn: CN=Network Configuration Operators
,CN=Builtin
,$
{DOMAINDN
}
328 description: Members in this group can have some administrative privileges to manage configuration of networking features
329 objectSid
: S
-1-5-32-556
330 sAMAccountName
: Network Configuration Operators
331 systemFlags
: -1946157056
332 groupType
: -2147483643
333 isCriticalSystemObject
: TRUE
335 dn: CN=Incoming Forest Trust Builders
,CN=Builtin
,$
{DOMAINDN
}
338 description: Members of this group can create incoming
, one
-way trusts to this forest
339 objectSid
: S
-1-5-32-557
340 sAMAccountName
: Incoming Forest Trust Builders
341 systemFlags
: -1946157056
342 groupType
: -2147483643
343 isCriticalSystemObject
: TRUE
345 dn: CN=Performance Monitor Users
,CN=Builtin
,$
{DOMAINDN
}
348 description: Members of this group have remote access to monitor this computer
349 objectSid
: S
-1-5-32-558
350 sAMAccountName
: Performance Monitor Users
351 systemFlags
: -1946157056
352 groupType
: -2147483643
353 isCriticalSystemObject
: TRUE
355 dn: CN=Performance Log Users
,CN=Builtin
,$
{DOMAINDN
}
358 description: Members of this group have remote access to schedule logging of performance counters on this computer
359 member
: CN=S
-1-5-20,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
360 objectSid
: S
-1-5-32-559
361 sAMAccountName
: Performance Log Users
362 systemFlags
: -1946157056
363 groupType
: -2147483643
364 isCriticalSystemObject
: TRUE
366 dn: CN=Windows Authorization Access Group
,CN=Builtin
,$
{DOMAINDN
}
369 description: Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects
370 member
: CN=S
-1-5-9,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
371 objectSid
: S
-1-5-32-560
372 sAMAccountName
: Windows Authorization Access Group
373 systemFlags
: -1946157056
374 groupType
: -2147483643
375 isCriticalSystemObject
: TRUE
377 dn: CN=Terminal Server License Servers
,CN=Builtin
,$
{DOMAINDN
}
380 description: Terminal Server License Servers
381 objectSid
: S
-1-5-32-561
382 sAMAccountName
: Terminal Server License Servers
383 systemFlags
: -1946157056
384 groupType
: -2147483643
385 isCriticalSystemObject
: TRUE
387 dn: CN=Distributed COM Users
,CN=Builtin
,$
{DOMAINDN
}
390 description: Members are allowed to launch
, activate and use Distributed COM objects on this machine.
391 objectSid
: S
-1-5-32-562
392 sAMAccountName
: Distributed COM Users
393 systemFlags
: -1946157056
394 groupType
: -2147483643
395 isCriticalSystemObject
: TRUE
397 dn: CN=IIS_IUSRS
,CN=Builtin
,$
{DOMAINDN
}
400 description: Integrated group used by the IIS
401 member
: CN=S
-1-5-17,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
402 objectSid
: S
-1-5-32-568
403 sAMAccountName
: IIS_IUSRS
404 systemFlags
: -1946157056
405 groupType
: -2147483643
406 isCriticalSystemObject
: TRUE
408 dn: CN=Cryptographic Operators
,CN=Builtin
,$
{DOMAINDN
}
411 description: Members are authorized to perform cryptographic operations.
412 objectSid
: S
-1-5-32-569
413 sAMAccountName
: Cryptographic Operators
414 systemFlags
: -1946157056
415 groupType
: -2147483643
416 isCriticalSystemObject
: TRUE
418 dn: CN=Event Log Readers
,CN=Builtin
,$
{DOMAINDN
}
421 description: Members of this group can read event logs from local machine.
422 objectSid
: S
-1-5-32-573
423 sAMAccountName
: Event Log Readers
424 systemFlags
: -1946157056
425 groupType
: -2147483643
426 isCriticalSystemObject
: TRUE
428 dn: CN=Certificate Service DCOM Access
,CN=Builtin
,$
{DOMAINDN
}
431 description: Members of this group are allowed to connect to Certification Authorities in the enterprise.
432 objectSid
: S
-1-5-32-574
433 sAMAccountName
: Certificate Service DCOM Access
434 systemFlags
: -1946157056
435 groupType
: -2147483643
436 isCriticalSystemObject
: TRUE
438 # Add well known security principals
440 dn: CN=WellKnown Security Principals
,$
{CONFIGDN
}
442 objectClass: container
443 systemFlags
: -2147483648
445 dn: CN=Anonymous Logon
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
447 objectClass: foreignSecurityPrincipal
450 dn: CN=Authenticated Users
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
452 objectClass: foreignSecurityPrincipal
455 dn: CN=Batch
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
457 objectClass: foreignSecurityPrincipal
460 dn: CN=Creator Group
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
462 objectClass: foreignSecurityPrincipal
465 dn: CN=Creator Owner
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
467 objectClass: foreignSecurityPrincipal
470 dn: CN=Dialup
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
472 objectClass: foreignSecurityPrincipal
475 dn: CN=Digest Authentication
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
477 objectClass: foreignSecurityPrincipal
478 objectSid
: S
-1-5-64-21
480 dn: CN=Enterprise Domain Controllers
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
482 objectClass: foreignSecurityPrincipal
485 dn: CN=Everyone
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
487 objectClass: foreignSecurityPrincipal
490 dn: CN=Interactive
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
492 objectClass: foreignSecurityPrincipal
495 dn: CN=IUSR
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
497 objectClass: foreignSecurityPrincipal
500 dn: CN=Local Service
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
502 objectClass: foreignSecurityPrincipal
505 dn: CN=Network
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
507 objectClass: foreignSecurityPrincipal
510 dn: CN=Network Service
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
512 objectClass: foreignSecurityPrincipal
515 dn: CN=NTLM Authentication
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
517 objectClass: foreignSecurityPrincipal
518 objectSid
: S
-1-5-64-10
520 dn: CN=Other Organization
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
522 objectClass: foreignSecurityPrincipal
523 objectSid
: S
-1-5-1000
525 dn: CN=Proxy
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
527 objectClass: foreignSecurityPrincipal
530 dn: CN=Remote Interactive Logon
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
532 objectClass: foreignSecurityPrincipal
535 dn: CN=Restricted
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
537 objectClass: foreignSecurityPrincipal
540 dn: CN=SChannel Authentication
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
542 objectClass: foreignSecurityPrincipal
543 objectSid
: S
-1-5-64-14
545 dn: CN=Self
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
547 objectClass: foreignSecurityPrincipal
550 dn: CN=Service
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
552 objectClass: foreignSecurityPrincipal
555 dn: CN=Terminal Server User
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
557 objectClass: foreignSecurityPrincipal
560 dn: CN=This Organization
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
562 objectClass: foreignSecurityPrincipal
565 dn: CN=Well
-Known
-Security
-Id
-System
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
567 objectClass: foreignSecurityPrincipal