AD管理特权群组管理.docxVIP

在Active Directory中，高特权帐户和组默认设置为被保护帐户和组。被委派管理员可以在对象上更改权限，包括更改权限，让自己改变组的成员。然而通过一个自动运行的后台进程，将确保受保护对象的权限与默认设置保持一致，哪怕有人手动更改受保护对象的权限，这个后台进程可以确保可以快速地返回到默认值。在WINOS中高特权帐号和群组如下所示保护企业管理员群组Securing Enterprise Admins Groups in Active Directory企业管理员群组作用于企业林根，为安全上考虑，不应该有每日登陆使用到的组成员。EA组默认隶属于林下的每个域的管理员组，你不应该将EA从域管理员组中移除出去，否则在恢复场景需要管理员的权限。The Enterprise Admins (EA) group, which is housed in the forest root domain, should contain no users on a day-to-day basis, Enterprise Admins are, by default, members of the Administrators group in each domain in the forest. You should not remove the EA group from the Administrators groups in each domain because in the event of a forest disaster recovery scenario, EA rights will likely be required. The forest’s Enterprise Admins group should be secured as detailed in the step-by-step instructions that follow.For the Enterprise Admins group in the forest:In GPOs linked to OUs containing member servers and workstations in each domain, the Enterprise Admins group should be added to the following user rights in Computer Configuration\Policies\Windows Settings\Security Settings\Local Settings\User Rights Assignments:Deny access to this computer from the networkDeny log on as a batch jobDeny log on as a serviceDeny log on locallyDeny log on through Remote Desktop ServicesConfigure auditing to send alerts if any modifications are made to the properties or membership of the Enterprise Admins group. Step-by-Step Instructions for Removing All Members from the Enterprise Admins GroupIn Server Manager, click Tools, and click Active Directory Users and Computers.If you are not managing the root domain for the forest, in the console tree, right-click Domain, and then click Change Domain… (where Domain is the name of the domain you’re currently administering).In the Change domain dialog box, click Browse…, select the root domain for the forest, and click OK.To remove all members from the EA group:Double-click the Enterprise Admins group and then click the Members