1 # Add default primary groups (domain users, domain guests, domain computers &
2 # domain controllers) - needed for the users to find valid primary groups
5 dn: CN=Domain Users
,CN=Users
,$
{DOMAINDN
}
8 description: All domain users
9 objectSid
: $
{DOMAINSID
}-513
10 sAMAccountName
: Domain Users
11 isCriticalSystemObject
: TRUE
13 dn: CN=Domain Guests
,CN=Users
,$
{DOMAINDN
}
16 description: All domain guests
17 objectSid
: $
{DOMAINSID
}-514
18 sAMAccountName
: Domain Guests
19 isCriticalSystemObject
: TRUE
21 dn: CN=Domain Computers
,CN=Users
,$
{DOMAINDN
}
24 description: All workstations and servers joined to the domain
25 objectSid
: $
{DOMAINSID
}-515
26 sAMAccountName
: Domain Computers
27 isCriticalSystemObject
: TRUE
29 dn: CN=Domain Controllers
,CN=Users
,$
{DOMAINDN
}
32 description: All domain controllers in the domain
33 objectSid
: $
{DOMAINSID
}-516
35 sAMAccountName
: Domain Controllers
36 isCriticalSystemObject
: TRUE
40 dn: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
42 description: Built
-in account for administering the computer
/domain
43 userAccountControl
: 66048
44 objectSid
: $
{DOMAINSID
}-500
46 accountExpires
: 9223372036854775807
47 sAMAccountName
: Administrator
48 userPassword:: $
{ADMINPASS_B64
}
49 isCriticalSystemObject
: TRUE
51 dn: CN=Guest
,CN=Users
,$
{DOMAINDN
}
53 description: Built
-in account for guest access to the computer
/domain
54 userAccountControl
: 66082
56 objectSid
: $
{DOMAINSID
}-501
58 isCriticalSystemObject
: TRUE
60 dn: CN=krbtgt
,CN=Users
,$
{DOMAINDN
}
63 objectClass: organizationalPerson
65 description: Key Distribution Center Service Account
66 showInAdvancedViewOnly
: TRUE
67 userAccountControl
: 514
68 objectSid
: $
{DOMAINSID
}-502
70 accountExpires
: 9223372036854775807
71 sAMAccountName
: krbtgt
72 servicePrincipalName
: kadmin
/changepw
73 userPassword:: $
{KRBTGTPASS_B64
}
74 isCriticalSystemObject
: TRUE
78 dn: CN=Enterprise Read
-Only Domain Controllers
,CN=Users
,$
{DOMAINDN
}
81 description: Members of this group are Read
-Only Domain Controllers in the enterprise
82 objectSid
: $
{DOMAINSID
}-498
83 sAMAccountName
: Enterprise Read
-Only Domain Controllers
84 groupType
: -2147483640
85 isCriticalSystemObject
: TRUE
87 dn: CN=Domain Admins
,CN=Users
,$
{DOMAINDN
}
90 description: Designated administrators of the domain
91 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
92 objectSid
: $
{DOMAINSID
}-512
94 sAMAccountName
: Domain Admins
95 isCriticalSystemObject
: TRUE
97 dn: CN=Cert Publishers
,CN=Users
,$
{DOMAINDN
}
100 description: Members of this group are permitted to publish certificates to the Active Directory
101 objectSid
: $
{DOMAINSID
}-517
102 sAMAccountName
: Cert Publishers
103 groupType
: -2147483644
104 isCriticalSystemObject
: TRUE
106 dn: CN=Schema Admins
,CN=Users
,$
{DOMAINDN
}
109 description: Designated administrators of the schema
110 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
111 objectSid
: $
{DOMAINSID
}-518
113 sAMAccountName
: Schema Admins
114 groupType
: -2147483640
115 isCriticalSystemObject
: TRUE
117 dn: CN=Enterprise Admins
,CN=Users
,$
{DOMAINDN
}
120 description: Designated administrators of the enterprise
121 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
122 objectSid
: $
{DOMAINSID
}-519
124 sAMAccountName
: Enterprise Admins
125 groupType
: -2147483640
126 isCriticalSystemObject
: TRUE
128 dn: CN=Group Policy Creator Owners
,CN=Users
,$
{DOMAINDN
}
131 description: Members in this group can
modify group policy for the domain
132 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
133 objectSid
: $
{DOMAINSID
}-520
134 sAMAccountName
: Group Policy Creator Owners
135 isCriticalSystemObject
: TRUE
137 dn: CN=Read
-Only Domain Controllers
,CN=Users
,$
{DOMAINDN
}
140 description: Members of this group are Read
-Only Domain Controllers in the domain
141 objectSid
: $
{DOMAINSID
}-521
143 sAMAccountName
: Read
-Only Domain Controllers
144 isCriticalSystemObject
: TRUE
146 dn: CN=RAS and IAS Servers
,CN=Users
,$
{DOMAINDN
}
149 description: Servers in this group can access remote access properties of users
150 objectSid
: $
{DOMAINSID
}-553
151 sAMAccountName
: RAS and IAS Servers
152 groupType
: -2147483644
153 isCriticalSystemObject
: TRUE
155 dn: CN=Allowed RODC Password Replication Group
,CN=Users
,$
{DOMAINDN
}
158 description: Members in this group can have their passwords replicated to all read
-only domain controllers in the domain.
159 objectSid
: $
{DOMAINSID
}-571
160 sAMAccountName
: Allowed RODC Password Replication Group
161 groupType
: -2147483644
162 isCriticalSystemObject
: TRUE
164 dn: CN=Denied RODC Password Replication Group
,CN=Users
,$
{DOMAINDN
}
167 description: Members in this group cannot have their passwords replicated to any read
-only domain controllers in the domain.
168 member
: CN=Read
-Only Domain Controllers
,CN=Users
,$
{DOMAINDN
}
169 member
: CN=Group Policy Creator Owners
,CN=Users
,$
{DOMAINDN
}
170 member
: CN=Domain Admins
,CN=Users
,$
{DOMAINDN
}
171 member
: CN=Cert Publishers
,CN=Users
,$
{DOMAINDN
}
172 member
: CN=Enterprise Admins
,CN=Users
,$
{DOMAINDN
}
173 member
: CN=Schema Admins
,CN=Users
,$
{DOMAINDN
}
174 member
: CN=Domain Controllers
,CN=Users
,$
{DOMAINDN
}
175 member
: CN=krbtgt
,CN=Users
,$
{DOMAINDN
}
176 objectSid
: $
{DOMAINSID
}-572
177 sAMAccountName
: Denied RODC Password Replication Group
178 groupType
: -2147483644
179 isCriticalSystemObject
: TRUE
181 # Add foreign security principals
183 dn: CN=S
-1-5-4,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
185 objectClass: foreignSecurityPrincipal
188 dn: CN=S
-1-5-9,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
190 objectClass: foreignSecurityPrincipal
193 dn: CN=S
-1-5-11,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
195 objectClass: foreignSecurityPrincipal
198 dn: CN=S
-1-5-20,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
200 objectClass: foreignSecurityPrincipal
203 # Add builtin objects
205 dn: CN=Administrators
,CN=Builtin
,$
{DOMAINDN
}
208 description: Administrators have complete and unrestricted access to the computer
/domain
209 member
: CN=Domain Admins
,CN=Users
,$
{DOMAINDN
}
210 member
: CN=Enterprise Admins
,CN=Users
,$
{DOMAINDN
}
211 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
212 objectSid
: S
-1-5-32-544
214 sAMAccountName
: Administrators
215 systemFlags
: -1946157056
216 groupType
: -2147483643
217 isCriticalSystemObject
: TRUE
219 dn: CN=Users
,CN=Builtin
,$
{DOMAINDN
}
222 description: Users are prevented from making accidental or intentional system
-wide changes. Thus
, Users can run certified applications
, but not most legacy applications
223 member
: CN=Domain Users
,CN=Users
,$
{DOMAINDN
}
224 member
: CN=S
-1-5-4,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
225 member
: CN=S
-1-5-11,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
226 objectSid
: S
-1-5-32-545
227 sAMAccountName
: Users
228 systemFlags
: -1946157056
229 groupType
: -2147483643
230 isCriticalSystemObject
: TRUE
232 dn: CN=Guests
,CN=Builtin
,$
{DOMAINDN
}
235 description: Guests have the same access as members of the Users group by default
, except for the Guest account which is further restricted
236 member
: CN=Domain Guests
,CN=Users
,$
{DOMAINDN
}
237 member
: CN=Guest
,CN=Users
,$
{DOMAINDN
}
238 objectSid
: S
-1-5-32-546
239 sAMAccountName
: Guests
240 systemFlags
: -1946157056
241 groupType
: -2147483643
242 isCriticalSystemObject
: TRUE
244 dn: CN=Account Operators
,CN=Builtin
,$
{DOMAINDN
}
247 description: Members can administer domain user and group accounts
248 objectSid
: S
-1-5-32-548
250 sAMAccountName
: Account Operators
251 systemFlags
: -1946157056
252 groupType
: -2147483643
253 isCriticalSystemObject
: TRUE
255 dn: CN=Server Operators
,CN=Builtin
,$
{DOMAINDN
}
258 description: Members can administer domain servers
259 objectSid
: S
-1-5-32-549
261 sAMAccountName
: Server Operators
262 systemFlags
: -1946157056
263 groupType
: -2147483643
264 isCriticalSystemObject
: TRUE
266 dn: CN=Print Operators
,CN=Builtin
,$
{DOMAINDN
}
269 description: Members can administer domain printers
270 objectSid
: S
-1-5-32-550
272 sAMAccountName
: Print Operators
273 systemFlags
: -1946157056
274 groupType
: -2147483643
275 isCriticalSystemObject
: TRUE
277 dn: CN=Backup Operators
,CN=Builtin
,$
{DOMAINDN
}
280 description: Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
281 objectSid
: S
-1-5-32-551
283 sAMAccountName
: Backup Operators
284 systemFlags
: -1946157056
285 groupType
: -2147483643
286 isCriticalSystemObject
: TRUE
288 dn: CN=Replicator
,CN=Builtin
,$
{DOMAINDN
}
291 description: Supports file replication in a domain
292 objectSid
: S
-1-5-32-552
294 sAMAccountName
: Replicator
295 systemFlags
: -1946157056
296 groupType
: -2147483643
297 isCriticalSystemObject
: TRUE
299 dn: CN=Pre
-Windows
2000 Compatible Access
,CN=Builtin
,$
{DOMAINDN
}
302 description: A backward compatibility group which allows read access on all users and groups in the domain
303 member
: CN=S
-1-5-11,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
304 objectSid
: S
-1-5-32-554
305 sAMAccountName
: Pre
-Windows
2000 Compatible Access
306 systemFlags
: -1946157056
307 groupType
: -2147483643
308 isCriticalSystemObject
: TRUE
310 dn: CN=Remote Desktop Users
,CN=Builtin
,$
{DOMAINDN
}
313 description: Members in this group are granted the right to logon remotely
314 objectSid
: S
-1-5-32-555
315 sAMAccountName
: Remote Desktop Users
316 systemFlags
: -1946157056
317 groupType
: -2147483643
318 isCriticalSystemObject
: TRUE
320 dn: CN=Network Configuration Operators
,CN=Builtin
,$
{DOMAINDN
}
323 description: Members in this group can have some administrative privileges to manage configuration of networking features
324 objectSid
: S
-1-5-32-556
325 sAMAccountName
: Network Configuration Operators
326 systemFlags
: -1946157056
327 groupType
: -2147483643
328 isCriticalSystemObject
: TRUE
330 dn: CN=Incoming Forest Trust Builders
,CN=Builtin
,$
{DOMAINDN
}
333 description: Members of this group can create incoming
, one
-way trusts to this forest
334 objectSid
: S
-1-5-32-557
335 sAMAccountName
: Incoming Forest Trust Builders
336 systemFlags
: -1946157056
337 groupType
: -2147483643
338 isCriticalSystemObject
: TRUE
340 dn: CN=Performance Monitor Users
,CN=Builtin
,$
{DOMAINDN
}
343 description: Members of this group have remote access to monitor this computer
344 objectSid
: S
-1-5-32-558
345 sAMAccountName
: Performance Monitor Users
346 systemFlags
: -1946157056
347 groupType
: -2147483643
348 isCriticalSystemObject
: TRUE
350 dn: CN=Performance Log Users
,CN=Builtin
,$
{DOMAINDN
}
353 description: Members of this group have remote access to schedule logging of performance counters on this computer
354 member
: CN=S
-1-5-20,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
355 objectSid
: S
-1-5-32-559
356 sAMAccountName
: Performance Log Users
357 systemFlags
: -1946157056
358 groupType
: -2147483643
359 isCriticalSystemObject
: TRUE
361 dn: CN=Windows Authorization Access Group
,CN=Builtin
,$
{DOMAINDN
}
364 description: Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects
365 member
: CN=S
-1-5-9,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
366 objectSid
: S
-1-5-32-560
367 sAMAccountName
: Windows Authorization Access Group
368 systemFlags
: -1946157056
369 groupType
: -2147483643
370 isCriticalSystemObject
: TRUE
372 dn: CN=Terminal Server License Servers
,CN=Builtin
,$
{DOMAINDN
}
375 description: Terminal Server License Servers
376 objectSid
: S
-1-5-32-561
377 sAMAccountName
: Terminal Server License Servers
378 systemFlags
: -1946157056
379 groupType
: -2147483643
380 isCriticalSystemObject
: TRUE
382 dn: CN=Distributed COM Users
,CN=Builtin
,$
{DOMAINDN
}
385 description: Members are allowed to launch
, activate and use Distributed COM objects on this machine.
386 objectSid
: S
-1-5-32-562
387 sAMAccountName
: Distributed COM Users
388 systemFlags
: -1946157056
389 groupType
: -2147483643
390 isCriticalSystemObject
: TRUE
392 dn: CN=Cryptographic Operators
,CN=Builtin
,$
{DOMAINDN
}
395 description: Members are authorized to perform cryptographic operations.
396 objectSid
: S
-1-5-32-569
397 sAMAccountName
: Cryptographic Operators
398 systemFlags
: -1946157056
399 groupType
: -2147483643
400 isCriticalSystemObject
: TRUE
402 dn: CN=Event Log Readers
,CN=Builtin
,$
{DOMAINDN
}
405 description: Members of this group can read event logs from local machine.
406 objectSid
: S
-1-5-32-573
407 sAMAccountName
: Event Log Readers
408 systemFlags
: -1946157056
409 groupType
: -2147483643
410 isCriticalSystemObject
: TRUE
412 dn: CN=Certificate Service DCOM Access
,CN=Builtin
,$
{DOMAINDN
}
415 description: Members of this group are allowed to connect to Certification Authorities in the enterprise.
416 objectSid
: S
-1-5-32-574
417 sAMAccountName
: Certificate Service DCOM Access
418 systemFlags
: -1946157056
419 groupType
: -2147483643
420 isCriticalSystemObject
: TRUE
422 # Add well known security principals
424 dn: CN=WellKnown Security Principals
,$
{CONFIGDN
}
426 objectClass: container
427 systemFlags
: -2147483648
429 dn: CN=Anonymous Logon
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
431 objectClass: foreignSecurityPrincipal
434 dn: CN=Authenticated Users
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
436 objectClass: foreignSecurityPrincipal
439 dn: CN=Batch
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
441 objectClass: foreignSecurityPrincipal
444 dn: CN=Creator Group
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
446 objectClass: foreignSecurityPrincipal
449 dn: CN=Creator Owner
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
451 objectClass: foreignSecurityPrincipal
454 dn: CN=Dialup
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
456 objectClass: foreignSecurityPrincipal
459 dn: CN=Digest Authentication
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
461 objectClass: foreignSecurityPrincipal
462 objectSid
: S
-1-5-64-21
464 dn: CN=Enterprise Domain Controllers
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
466 objectClass: foreignSecurityPrincipal
469 dn: CN=Everyone
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
471 objectClass: foreignSecurityPrincipal
474 dn: CN=Interactive
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
476 objectClass: foreignSecurityPrincipal
479 dn: CN=Local Service
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
481 objectClass: foreignSecurityPrincipal
484 dn: CN=Network
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
486 objectClass: foreignSecurityPrincipal
489 dn: CN=Network Service
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
491 objectClass: foreignSecurityPrincipal
494 dn: CN=NTLM Authentication
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
496 objectClass: foreignSecurityPrincipal
497 objectSid
: S
-1-5-64-10
499 dn: CN=Other Organization
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
501 objectClass: foreignSecurityPrincipal
502 objectSid
: S
-1-5-1000
504 dn: CN=Proxy
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
506 objectClass: foreignSecurityPrincipal
509 dn: CN=Remote Interactive Logon
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
511 objectClass: foreignSecurityPrincipal
514 dn: CN=Restricted
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
516 objectClass: foreignSecurityPrincipal
519 dn: CN=SChannel Authentication
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
521 objectClass: foreignSecurityPrincipal
522 objectSid
: S
-1-5-64-14
524 dn: CN=Self
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
526 objectClass: foreignSecurityPrincipal
529 dn: CN=Service
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
531 objectClass: foreignSecurityPrincipal
534 dn: CN=Terminal Server User
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
536 objectClass: foreignSecurityPrincipal
539 dn: CN=This Organization
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
541 objectClass: foreignSecurityPrincipal
544 dn: CN=Well
-Known
-Security
-Id
-System
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
546 objectClass: foreignSecurityPrincipal