1 # Add default primary groups (domain users, domain guests, domain computers &
2 # domain controllers) - needed for the users to find valid primary groups
5 dn: CN=Domain Users
,CN=Users
,$
{DOMAINDN
}
8 description: All domain users
9 objectSid
: $
{DOMAINSID
}-513
10 sAMAccountName
: Domain Users
11 isCriticalSystemObject
: TRUE
13 dn: CN=Domain Guests
,CN=Users
,$
{DOMAINDN
}
16 description: All domain guests
17 objectSid
: $
{DOMAINSID
}-514
18 sAMAccountName
: Domain Guests
19 isCriticalSystemObject
: TRUE
21 dn: CN=Domain Computers
,CN=Users
,$
{DOMAINDN
}
24 description: All workstations and servers joined to the domain
25 objectSid
: $
{DOMAINSID
}-515
26 sAMAccountName
: Domain Computers
27 isCriticalSystemObject
: TRUE
29 dn: CN=Domain Controllers
,CN=Users
,$
{DOMAINDN
}
32 description: All domain controllers in the domain
33 objectSid
: $
{DOMAINSID
}-516
35 sAMAccountName
: Domain Controllers
36 isCriticalSystemObject
: TRUE
40 dn: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
42 description: Built
-in account for administering the computer
/domain
43 userAccountControl
: 66048
44 objectSid
: $
{DOMAINSID
}-500
46 accountExpires
: 9223372036854775807
47 sAMAccountName
: Administrator
48 userPassword:: $
{ADMINPASS_B64
}
49 isCriticalSystemObject
: TRUE
51 dn: CN=Guest
,CN=Users
,$
{DOMAINDN
}
53 description: Built
-in account for guest access to the computer
/domain
54 userAccountControl
: 66082
56 objectSid
: $
{DOMAINSID
}-501
58 isCriticalSystemObject
: TRUE
60 dn: CN=krbtgt
,CN=Users
,$
{DOMAINDN
}
63 objectClass: organizationalPerson
65 description: Key Distribution Center Service Account
66 showInAdvancedViewOnly
: TRUE
67 userAccountControl
: 514
68 objectSid
: $
{DOMAINSID
}-502
70 accountExpires
: 9223372036854775807
71 sAMAccountName
: krbtgt
72 servicePrincipalName
: kadmin
/changepw
73 userPassword:: $
{KRBTGTPASS_B64
}
74 isCriticalSystemObject
: TRUE
78 dn: CN=Enterprise Admins
,CN=Users
,$
{DOMAINDN
}
81 description: Designated administrators of the enterprise
82 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
83 objectSid
: $
{DOMAINSID
}-519
85 sAMAccountName
: Enterprise Admins
86 isCriticalSystemObject
: TRUE
88 dn: CN=Schema Admins
,CN=Users
,$
{DOMAINDN
}
91 description: Designated administrators of the schema
92 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
93 objectSid
: $
{DOMAINSID
}-518
95 sAMAccountName
: Schema Admins
96 isCriticalSystemObject
: TRUE
98 dn: CN=Cert Publishers
,CN=Users
,$
{DOMAINDN
}
101 description: Members of this group are permitted to publish certificates to the Active Directory
102 groupType
: -2147483644
103 objectSid
: $
{DOMAINSID
}-517
104 sAMAccountName
: Cert Publishers
105 isCriticalSystemObject
: TRUE
107 dn: CN=Domain Admins
,CN=Users
,$
{DOMAINDN
}
110 description: Designated administrators of the domain
111 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
112 objectSid
: $
{DOMAINSID
}-512
114 sAMAccountName
: Domain Admins
115 isCriticalSystemObject
: TRUE
117 dn: CN=Group Policy Creator Owners
,CN=Users
,$
{DOMAINDN
}
120 description: Members in this group can
modify group policy for the domain
121 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
122 objectSid
: $
{DOMAINSID
}-520
123 sAMAccountName
: Group Policy Creator Owners
124 isCriticalSystemObject
: TRUE
126 dn: CN=RAS and IAS Servers
,CN=Users
,$
{DOMAINDN
}
129 description: Servers in this group can access remote access properties of users
130 objectSid
: $
{DOMAINSID
}-553
131 sAMAccountName
: RAS and IAS Servers
132 groupType
: -2147483644
133 isCriticalSystemObject
: TRUE
135 dn: CN=Read
-Only Domain Controllers
,CN=Users
,$
{DOMAINDN
}
138 description: Read
-only domain controllers
139 objectSid
: $
{DOMAINSID
}-521
140 sAMAccountName
: Read
-Only Domain Controllers
141 groupType
: -2147483644
142 isCriticalSystemObject
: TRUE
144 dn: CN=Enterprise Read
-Only Domain Controllers
,CN=Users
,$
{DOMAINDN
}
147 description: Enterprise read
-only domain controllers
148 objectSid
: $
{DOMAINSID
}-498
149 sAMAccountName
: Enterprise Read
-Only Domain Controllers
150 groupType
: -2147483644
151 isCriticalSystemObject
: TRUE
153 dn: CN=Certificate Service DCOM Access
,CN=Users
,$
{DOMAINDN
}
156 description: Certificate Service DCOM Access
157 objectSid
: $
{DOMAINSID
}-574
158 sAMAccountName
: Certificate Service DCOM Access
159 groupType
: -2147483644
160 isCriticalSystemObject
: TRUE
162 dn: CN=Cryptographic Operators
,CN=Users
,$
{DOMAINDN
}
165 description: Cryptographic Operators
166 objectSid
: $
{DOMAINSID
}-569
167 sAMAccountName
: Cryptographic Operators
168 groupType
: -2147483644
169 isCriticalSystemObject
: TRUE
171 dn: CN=Event Log Readers
,CN=Users
,$
{DOMAINDN
}
174 description: Event Log Readers
175 objectSid
: $
{DOMAINSID
}-573
176 sAMAccountName
: Event Log Readers
177 groupType
: -2147483644
178 isCriticalSystemObject
: TRUE
180 # Add foreign security principals
182 dn: CN=S
-1-5-4,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
184 objectClass: foreignSecurityPrincipal
187 dn: CN=S
-1-5-9,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
189 objectClass: foreignSecurityPrincipal
192 dn: CN=S
-1-5-11,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
194 objectClass: foreignSecurityPrincipal
197 dn: CN=S
-1-5-20,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
199 objectClass: foreignSecurityPrincipal
202 # Add builtin objects
204 dn: CN=Administrators
,CN=Builtin
,$
{DOMAINDN
}
207 description: Administrators have complete and unrestricted access to the computer
/domain
208 member
: CN=Domain Admins
,CN=Users
,$
{DOMAINDN
}
209 member
: CN=Enterprise Admins
,CN=Users
,$
{DOMAINDN
}
210 member
: CN=Administrator
,CN=Users
,$
{DOMAINDN
}
211 objectSid
: S
-1-5-32-544
213 sAMAccountName
: Administrators
214 systemFlags
: -1946157056
215 groupType
: -2147483643
216 isCriticalSystemObject
: TRUE
218 dn: CN=Users
,CN=Builtin
,$
{DOMAINDN
}
221 description: Users are prevented from making accidental or intentional system
-wide changes. Thus
, Users can run certified applications
, but not most legacy applications
222 member
: CN=Domain Users
,CN=Users
,$
{DOMAINDN
}
223 member
: CN=S
-1-5-4,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
224 member
: CN=S
-1-5-11,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
225 objectSid
: S
-1-5-32-545
226 sAMAccountName
: Users
227 systemFlags
: -1946157056
228 groupType
: -2147483643
229 isCriticalSystemObject
: TRUE
231 dn: CN=Guests
,CN=Builtin
,$
{DOMAINDN
}
234 description: Guests have the same access as members of the Users group by default
, except for the Guest account which is further restricted
235 member
: CN=Domain Guests
,CN=Users
,$
{DOMAINDN
}
236 member
: CN=Guest
,CN=Users
,$
{DOMAINDN
}
237 objectSid
: S
-1-5-32-546
238 sAMAccountName
: Guests
239 systemFlags
: -1946157056
240 groupType
: -2147483643
241 isCriticalSystemObject
: TRUE
243 dn: CN=Print Operators
,CN=Builtin
,$
{DOMAINDN
}
246 description: Members can administer domain printers
247 objectSid
: S
-1-5-32-550
249 sAMAccountName
: Print Operators
250 systemFlags
: -1946157056
251 groupType
: -2147483643
252 isCriticalSystemObject
: TRUE
254 dn: CN=Backup Operators
,CN=Builtin
,$
{DOMAINDN
}
257 description: Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
258 objectSid
: S
-1-5-32-551
260 sAMAccountName
: Backup Operators
261 systemFlags
: -1946157056
262 groupType
: -2147483643
263 isCriticalSystemObject
: TRUE
265 dn: CN=Replicator
,CN=Builtin
,$
{DOMAINDN
}
268 description: Supports file replication in a domain
269 objectSid
: S
-1-5-32-552
271 sAMAccountName
: Replicator
272 systemFlags
: -1946157056
273 groupType
: -2147483643
274 isCriticalSystemObject
: TRUE
276 dn: CN=Remote Desktop Users
,CN=Builtin
,$
{DOMAINDN
}
279 description: Members in this group are granted the right to logon remotely
280 objectSid
: S
-1-5-32-555
281 sAMAccountName
: Remote Desktop Users
282 systemFlags
: -1946157056
283 groupType
: -2147483643
284 isCriticalSystemObject
: TRUE
286 dn: CN=Network Configuration Operators
,CN=Builtin
,$
{DOMAINDN
}
289 description: Members in this group can have some administrative privileges to manage configuration of networking features
290 objectSid
: S
-1-5-32-556
291 sAMAccountName
: Network Configuration Operators
292 systemFlags
: -1946157056
293 groupType
: -2147483643
294 isCriticalSystemObject
: TRUE
296 dn: CN=Performance Monitor Users
,CN=Builtin
,$
{DOMAINDN
}
299 description: Members of this group have remote access to monitor this computer
300 objectSid
: S
-1-5-32-558
301 sAMAccountName
: Performance Monitor Users
302 systemFlags
: -1946157056
303 groupType
: -2147483643
304 isCriticalSystemObject
: TRUE
306 dn: CN=Performance Log Users
,CN=Builtin
,$
{DOMAINDN
}
309 description: Members of this group have remote access to schedule logging of performance counters on this computer
310 member
: CN=S
-1-5-20,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
311 objectSid
: S
-1-5-32-559
312 sAMAccountName
: Performance Log Users
313 systemFlags
: -1946157056
314 groupType
: -2147483643
315 isCriticalSystemObject
: TRUE
317 dn: CN=Server Operators
,CN=Builtin
,$
{DOMAINDN
}
320 description: Members can administer domain servers
321 objectSid
: S
-1-5-32-549
323 sAMAccountName
: Server Operators
324 systemFlags
: -1946157056
325 groupType
: -2147483643
326 isCriticalSystemObject
: TRUE
328 dn: CN=Account Operators
,CN=Builtin
,$
{DOMAINDN
}
331 description: Members can administer domain user and group accounts
332 objectSid
: S
-1-5-32-548
334 sAMAccountName
: Account Operators
335 systemFlags
: -1946157056
336 groupType
: -2147483643
337 isCriticalSystemObject
: TRUE
339 dn: CN=Pre
-Windows
2000 Compatible Access
,CN=Builtin
,$
{DOMAINDN
}
342 description: A backward compatibility group which allows read access on all users and groups in the domain
343 member
: CN=S
-1-5-11,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
344 objectSid
: S
-1-5-32-554
345 sAMAccountName
: Pre
-Windows
2000 Compatible Access
346 systemFlags
: -1946157056
347 groupType
: -2147483643
348 isCriticalSystemObject
: TRUE
350 dn: CN=Incoming Forest Trust Builders
,CN=Builtin
,$
{DOMAINDN
}
353 description: Members of this group can create incoming
, one
-way trusts to this forest
354 objectSid
: S
-1-5-32-557
355 sAMAccountName
: Incoming Forest Trust Builders
356 systemFlags
: -1946157056
357 groupType
: -2147483643
358 isCriticalSystemObject
: TRUE
360 dn: CN=Windows Authorization Access Group
,CN=Builtin
,$
{DOMAINDN
}
363 description: Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects
364 member
: CN=S
-1-5-9,CN=ForeignSecurityPrincipals
,$
{DOMAINDN
}
365 objectSid
: S
-1-5-32-560
366 sAMAccountName
: Windows Authorization Access Group
367 systemFlags
: -1946157056
368 groupType
: -2147483643
369 isCriticalSystemObject
: TRUE
371 dn: CN=Terminal Server License Servers
,CN=Builtin
,$
{DOMAINDN
}
374 description: Terminal Server License Servers
375 objectSid
: S
-1-5-32-561
376 sAMAccountName
: Terminal Server License Servers
377 systemFlags
: -1946157056
378 groupType
: -2147483643
379 isCriticalSystemObject
: TRUE
381 dn: CN=Distributed COM Users
,CN=Builtin
,$
{DOMAINDN
}
384 description: Members are allowed to launch
, activate and use Distributed COM objects on this machine.
385 objectSid
: S
-1-5-32-562
386 sAMAccountName
: Distributed COM Users
387 systemFlags
: -1946157056
388 groupType
: -2147483643
389 isCriticalSystemObject
: TRUE
391 # Add well known security principals
393 dn: CN=WellKnown Security Principals
,$
{CONFIGDN
}
395 objectClass: container
396 systemFlags
: -2147483648
398 dn: CN=Anonymous Logon
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
400 objectClass: foreignSecurityPrincipal
403 dn: CN=Authenticated Users
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
405 objectClass: foreignSecurityPrincipal
408 dn: CN=Batch
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
410 objectClass: foreignSecurityPrincipal
413 dn: CN=Creator Group
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
415 objectClass: foreignSecurityPrincipal
418 dn: CN=Creator Owner
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
420 objectClass: foreignSecurityPrincipal
423 dn: CN=Dialup
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
425 objectClass: foreignSecurityPrincipal
428 dn: CN=Digest Authentication
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
430 objectClass: foreignSecurityPrincipal
431 objectSid
: S
-1-5-64-21
433 dn: CN=Enterprise Domain Controllers
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
435 objectClass: foreignSecurityPrincipal
438 dn: CN=Everyone
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
440 objectClass: foreignSecurityPrincipal
443 dn: CN=Interactive
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
445 objectClass: foreignSecurityPrincipal
448 dn: CN=Local Service
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
450 objectClass: foreignSecurityPrincipal
453 dn: CN=Network
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
455 objectClass: foreignSecurityPrincipal
458 dn: CN=Network Service
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
460 objectClass: foreignSecurityPrincipal
463 dn: CN=NTLM Authentication
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
465 objectClass: foreignSecurityPrincipal
466 objectSid
: S
-1-5-64-10
468 dn: CN=Other Organization
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
470 objectClass: foreignSecurityPrincipal
471 objectSid
: S
-1-5-1000
473 dn: CN=Proxy
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
475 objectClass: foreignSecurityPrincipal
478 dn: CN=Remote Interactive Logon
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
480 objectClass: foreignSecurityPrincipal
483 dn: CN=Restricted
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
485 objectClass: foreignSecurityPrincipal
488 dn: CN=SChannel Authentication
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
490 objectClass: foreignSecurityPrincipal
491 objectSid
: S
-1-5-64-14
493 dn: CN=Self
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
495 objectClass: foreignSecurityPrincipal
498 dn: CN=Service
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
500 objectClass: foreignSecurityPrincipal
503 dn: CN=Terminal Server User
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
505 objectClass: foreignSecurityPrincipal
508 dn: CN=This Organization
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
510 objectClass: foreignSecurityPrincipal
513 dn: CN=Well
-Known
-Security
-Id
-System
,CN=WellKnown Security Principals
,$
{CONFIGDN
}
515 objectClass: foreignSecurityPrincipal