ACL ACL in Active Directory & LDAP

Question 1

In Active Directory, what is an Access Control Entry (ACE)?

Accepted Answer

An individual permission rule specifying a trustee and the access rights granted or denied

Answer

An ACE is a single entry within an ACL that identifies a trustee (user, group, or computer) and specifies which access rights are allowed or denied for that trustee.

Question 2

Which tool and setting must be enabled to view and edit ACLs on Active Directory objects?

Accepted Answer

Active Directory Users and Computers with Advanced Features enabled

Answer

Enabling 'Advanced Features' under the View menu in ADUC exposes the Security tab, allowing administrators to view and modify ACLs on Active Directory objects.

Question 3

What is AdminSDHolder in Active Directory?

Accepted Answer

A protected container object whose ACL is periodically applied to privileged accounts and groups

Answer

AdminSDHolder is a special AD container whose ACL is automatically propagated to all protected accounts (such as Domain Admins members) by the SDProp process every 60 minutes.

Question 4

In LDAP implementations, where is access control information typically stored for directory entries?

Accepted Answer

In operational attributes such as `aci` or `entryACI`

Answer

LDAP servers such as OpenLDAP and 389 Directory Server store access control information in server-specific operational attributes like `aci` or `entryACI` rather than standard visible attributes.

Question 5

What Active Directory permission allows a user to create new objects within an Organizational Unit?

Accepted Answer

Create Child Objects

Answer

The 'Create Child Objects' permission grants the right to create new objects such as users, groups, and computers within an OU or container.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL ACL in Active Directory & LDAP