Schema vs. Enterprise vs. Domain Admins

by Mitch Tulloch [Published on 20 June 2007 / Last Updated on 20 June 2007]

Domain admins can basically do anything, anywhere in the forest.

You have to choose who will be your domain admins very carefully, even in a multi-domain environment. That’s because there are exploits that can enable Domain Admins to make themselves into Enterprise Admins or even Schema Admins! And this works even if you are a Domain Admin in a child domain! What this means that if you need true separation of admin powers, you need to deploy multiple forests. That’s because the forest is the only real security boundary in Active Directory. Domains are not true security boundaries. And this is also reason that Microsoft has stopped promoting the idea of an empty forest root domain where only Enterprise Admins reside, since these exploits can enable a Domain Admin in a child domain to easily become an Enterprise Admin and own the forest.

***

Mitch Tulloch was lead author for the Windows Vista Resource Kit from Microsoft Press, which is THE book for IT pros who want to deploy, maintain and support Windows Vista in mid- and large-sized network environments. For more information see www.mtit.com.

The Author — Mitch Tulloch

Mitch Tulloch is a widely recognized expert on Windows administration, networking, and security. He has been repeatedly awarded Most Valuable Professional (MVP) status by Microsoft for his outstanding contributions in supporting users who deploy and use Microsoft platforms, products and solutions. Mitch has published over two hundred articles on different IT websites and magazines, and he has written or contributed to almost two dozen books and is lead author for the Windows 7 Resource Kit from Microsoft Press. For more information, see www.mtit.com .

Latest Contributions

Featured Links