Bypassing accidental deletion protection

Question

Hi

Objects marked protect from accidental deletion were still removed during scripted cleanup.

How was this bypass possible, and how to enforce stricter protection ?

Answer 1

Welcome to Microsoft Q&A!

Thank you for sharing the details of your issue.

The "Protect object from accidental deletion" setting in Active Directory is designed to help prevent unintended deletions, but it is not a security boundary. When enabled, Active Directory implements this protection by adding Deny Delete and Deny Delete Subtree permissions to the object's Access Control List (ACL). These deny entries help prevent standard deletion operations, including accidental deletions performed by administrators. However, they do not prevent deletion by accounts that have sufficient privileges to modify the object's permissions or security descriptor.

However, an account with sufficient privileges, such as a Domain Admin, Enterprise Admin, or a delegated account with permission to modify ACLs, can still:

1. Remove or modify the protection-related ACEs.
2. Change the object's security permissions.
3. Delete the object after the protection has been removed.

As a result, scripted cleanup processes running under highly privileged credentials may still be able to delete protected objects if the script removes, modifies, or overrides the protection settings before performing the deletion. Therefore, this feature should be viewed as a safeguard against accidental deletions rather than an absolute protection mechanism, since sufficiently privileged accounts can alter the permissions that enforce the protection.

How to Enforce Stronger Protection

To reduce the likelihood of privileged processes bypassing this protection, you can consider the following for the best practices:

• Run automation using the least privileges required rather than Domain Admin or Enterprise Admin credentials.
• Restrict who can modify object ACLs and OU permissions.
• Use delegation to separate routine administrative tasks from privileged administrative functions.
• Enable Active Directory Recycle Bin to simplify recovery if an object is deleted.
• Enable auditing of permission changes and object deletions to identify when protection settings are modified or removed.
• Implement change-control or approval processes for bulk cleanup operations.

If a script has sufficient privileges to modify an object's security descriptor, it can effectively bypass Protect object from accidental deletion by removing the associated deny permissions before deletion. This behavior is expected and by design. The feature helps prevent accidental administrative actions, but it does not prevent deletion by accounts that are authorized to alter security permissions.

References:

Preventing Unwanted/Accidental deletions and Restore deleted objects in Active Directory | Microsoft Learn

Active Directory Accidental Deletion - Prevention & Cure | Microsoft Learn

I hope this information helps. If you find the answer helpful, please consider clicking Accept Answer and upvoting it.

Thank you for using Microsoft Q&A!