GenericAll ACL on "Domain Admins" Group

Question

After installation of Exchange (onPrem), we noticed that there are some additional permission configured on the "Domain Admins" group (Tool: Pingcastle)
Does anybody know what effect these permission have? What can the members of "Exchange Trusted Subsystems" do with the "GenericAll" right?

ActiveDirectoryRights : GenericAll
InheritanceType : Descendents
ObjectType : 00000000-0000-0000-0000-000000000000
InheritedObjectType : f0f8ffac-1191-11d0-a060-00aa006c33ed
ObjectFlags : InheritedObjectAceTypePresent
AccessControlType : Allow
IdentityReference : DOMAIN\Exchange Trusted Subsystem
IsInherited : False
InheritanceFlags : ContainerInherit
PropagationFlags : InheritOnly

ActiveDirectoryRights : GenericAll
InheritanceType : Descendents
ObjectType : 00000000-0000-0000-0000-000000000000
InheritedObjectType : c975c901-6cea-4b6f-8319-d67f45449506
ObjectFlags : InheritedObjectAceTypePresent
AccessControlType : Allow
IdentityReference : DOMAIN\Exchange Trusted Subsystem
IsInherited : False
InheritanceFlags : ContainerInherit
PropagationFlags : InheritOnly

ActiveDirectoryRights : GenericAll
InheritanceType : All
ObjectType : 018849b0-a981-11d2-a9ff-00c04f8eedd8
InheritedObjectType : 00000000-0000-0000-0000-000000000000
ObjectFlags : ObjectAceTypePresent
AccessControlType : Allow
IdentityReference : DOMAIN\Exchange Trusted Subsystem
IsInherited : False
InheritanceFlags : ContainerInherit
PropagationFlags : None

We want to ensure, that no other users (excepting the Domain Admins) are able to modify the Domain-Admins group.

Answer 1

Hi @ErazerMe

The exchange install has updated the permissions on the AdminSDHolder Object, which has in turn updated the permissions on the protected groups via the SDProp Process referenced here: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory

The GenericAll right is the same as Full Control.

The Exchange Trusted Subsystem typically contains the exchange servers computer objects, this right is required by Exchange to manage the mail configuration for the object.

Gary.

Answer 2

Hi there,

GenericAll means user with full permission and it is dangerous to provide this other than trusted group members.

Domain Admin group has full rights to the object (add users to a group or reset user's password).You can delegate permission but you must change the security group of the users.

"Privileged" accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are granted that allow them to perform nearly any action in Active Directory and on domain-joined systems.

How Access Control Works in Active Directory Domain Services https://learn.microsoft.com/en-us/windows/win32/ad/how-access-control-works-in-active-directory-domain-services

Privileged Accounts and Groups in Active Directory https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory

Active Directory Security Groups https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups

------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--