sthAdminSDHolder - it is a module containing five functions for work with Active Directory groups and user accounts, protected by AdminSDHolder container.
When you add user to one of the protected groups, like 'Account Operators', 'Administrators', 'Backup Operators', 'Domain Admins', 'Domain Controllers', 'Enterprise Admins', 'Print Operators', 'Read-only Domain Controllers', 'Replicator', 'Schema Admins' or 'Server Operators', it becomes protected too.
User account object's attribute adminCount is set to '1' and access rights become that of the AdminSDHolder container (CN=AdminSDHolder,CN=System,DC=domain,DC=com).
By default, access rights inheritance for AdminSDHolder is disabled. And so it is for protected user objects.
When you remove user from protected group, adminCount attribute is not removed and its value is not changed. Also, permissions inheritance for the object is not enabled. To remove adminCount attribute and enable access rights inheritance you can use this module's functions: Get-sthAdminSDHolderProtectedUserAccount and Remove-sthAdminSDHolderUserAccountProtection.
Also, you can exclude 'Account Operators', 'Server Operators', 'Print Operators' or 'Backup Operators' groups from protection (and include again) by adjusting dsHeuristics attribute of 'Directory Service' container (CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=domain,DC=com).
You can do this using functions: Get-sthAdminSDHolderGroup, Disable-sthAdminSDHolderGroupProtection, Enable-sthAdminSDHolderGroupProtection.
Get-sthAdminSDHolderProtectedUserAccount - Function gets Active Directory user accounts, protected by AdminSDHolder. It returns Name, SamAccountName, UserPrincipalName, whether account is enabled, adminCount attribute value, whether access rights inheritance is enabled and list of protected groups the user is member of.
Remove-sthAdminSDHolderUserAccountProtection - Function removes adminCount attribute and enables access rules inheritance for the user object, that no longer belongs to groups, protected by AdminSDHolder container.
Get-sthAdminSDHolderGroup - Function gets the Active Directory groups, protected by AdminSDHolder container. It returns dsHeuristics attribute value, protected groups, and also groups, excluded from protection, if any.
Disable-sthAdminSDHolderGroupProtection - Function disables protection by AdminSDHolder container for Account Operators, Server Operators, Print Operators or Backup Operators groups.
Enable-sthAdminSDHolderGroupProtection - Function enables protection by AdminSDHolder container for Account Operators, Server Operators, Print Operators or Backup Operators groups.
You can install sthAdminSDHolder module from PowerShell Gallery:
Install-Module sthAdminSDHolderThe command returns information about user accounts, protected by AdminSDHolder container. Output includes disabled user accounts.
Get-sthAdminSDHolderProtectedUserAccount
Name SamAccountName UserPrincipalName Enabled AdminCountAttribute InheritanceEnabled AdminSDHolderGroups
---- -------------- ----------------- ------- ------------------- ------------------ -------------------
admin admin admin@domain.com True 1 False {Administrators, Domain Admins, Enterprise Admins, Schema Admins}
user user user@domain.com True 1 False {Account Operators}
disableduser disableduser disableduser@domain.com False 1 False {Print Operators}
The command returns information about user accounts, protected by AdminSDHolder container. Output includes only enabled user accounts.
Get-sthAdminSDHolderProtectedUserAccount -EnabledOnlyName SamAccountName UserPrincipalName Enabled AdminCountAttribute InheritanceEnabled AdminSDHolderGroups
---- -------------- ----------------- ------- ------------------- ------------------ -------------------
admin admin admin@domain.com True 1 False {Administrators, Domain Admins, Enterprise Admins, Schema Admins}
user user user@domain.com True 1 False {Account Operators}
The command returns information about user accounts, protected by AdminSDHolder container, using ambiguous name resolution.
Get-sthAdminSDHolderProtectedUserAccount -ANR uName SamAccountName UserPrincipalName Enabled AdminCountAttribute InheritanceEnabled AdminSDHolderGroups
---- -------------- ----------------- ------- ------------------- ------------------ -------------------
user user user@domain.com True 1 False {Account Operators}
The command returns information about user account, protected by AdminSDHolder container, using SamAccountName user object attribute.
Get-sthAdminSDHolderProtectedUserAccount -SamAccountName userName SamAccountName UserPrincipalName Enabled AdminCountAttribute InheritanceEnabled AdminSDHolderGroups
---- -------------- ----------------- ------- ------------------- ------------------ -------------------
user user user@domain.com True 1 False {Account Operators}
The command returns information about user account, protected by AdminSDHolder container, using UserPrincipalName user object attribute.
Get-sthAdminSDHolderProtectedUserAccount -UserPrincipalName user@domain.comName SamAccountName UserPrincipalName Enabled AdminCountAttribute InheritanceEnabled AdminSDHolderGroups
---- -------------- ----------------- ------- ------------------- ------------------ -------------------
user user user@domain.com True 1 False {Account Operators}
The command removes adminCount attribute and enables access rules inheritance for the user account. The account was specified by using its SamAccountName.
Remove-sthAdminSDHolderUserAccountProtection -SamAccountName user -Remove -YesRemoveRemoving adminCount attribute and enabling access rules inheritance.
Name SamAccountName UserPrincipalName Enabled AdminCountAttribute InheritanceEnabled AdminSDHolderGroups
---- -------------- ----------------- ------- ------------------- ------------------ -------------------
user user user@domain.com True 1 False {}
adminCount attribute removed.
Access rules inheritance enabled.
The command removes adminCount attribute and enables access rules inheritance for the user account. The account was specified by using its UserPrincipalName.
Remove-sthAdminSDHolderUserAccountProtection -UserPrincipalName user@domain.com -Remove -YesRemoveRemoving adminCount attribute and enabling access rules inheritance.
Name SamAccountName UserPrincipalName Enabled AdminCountAttribute InheritanceEnabled AdminSDHolderGroups
---- -------------- ----------------- ------- ------------------- ------------------ -------------------
user user user@domain.com True 1 False {}
adminCount attribute removed.
Access rules inheritance enabled.
The command does not make changes to user account, because it still is a member of a protected group.
Remove-sthAdminSDHolderUserAccountProtection -SamAccountName username -Remove -YesRemoveAccount is a member of AdminSDHolder protected groups.
Name SamAccountName UserPrincipalName Enabled AdminCountAttribute InheritanceEnabled AdminSDHolderGroups
---- -------------- ----------------- ------- ------------------- ------------------ -------------------
user user user@domain.com True 1 False {Account Operators}
No changes were made.
The command gets the value of dsHeuristics attribute and a list of groups, protected by AdminSDHolder container.
Get-sthAdminSDHolderGroup dsHeuristics: null
Protected Groups:
Name SID distinguishedName
---- --- -----------------
Account Operators S-1-5-32-548 CN=Account Operators,CN=Builtin,DC=domain,DC=com
Administrators S-1-5-32-544 CN=Administrators,CN=Builtin,DC=domain,DC=com
Backup Operators S-1-5-32-551 CN=Backup Operators,CN=Builtin,DC=domain,DC=com
Domain Admins S-1-5-21-1234567890-1234567890-1234567890-512 CN=Domain Admins,CN=Users,DC=domain,DC=com
Domain Controllers S-1-5-21-1234567890-1234567890-1234567890-516 CN=Domain Controllers,CN=Users,DC=domain,DC=com
Enterprise Admins S-1-5-21-1234567890-1234567890-1234567890-519 CN=Enterprise Admins,CN=Users,DC=domain,DC=com
Print Operators S-1-5-32-550 CN=Print Operators,CN=Builtin,DC=domain,DC=com
Read-only Domain Controllers S-1-5-21-1234567890-1234567890-1234567890-521 CN=Read-only Domain Controllers,CN=Users,DC=domain,DC=com
Replicator S-1-5-32-552 CN=Replicator,CN=Builtin,DC=domain,DC=com
Schema Admins S-1-5-21-1234567890-1234567890-1234567890-518 CN=Schema Admins,CN=Users,DC=domain,DC=com
Server Operators S-1-5-32-549 CN=Server Operators,CN=Builtin,DC=domain,DC=com
The command gets the value of dsHeuristics attribute and a list of groups protected by AdminSDHolder container. Also function returns the list of groups, excluded from protection by virtue of 16'th character's value of dsHeuristics attribute.
Get-sthAdminSDHolderGroup dsHeuristics: 000000000100000f
Protected Groups:
Name SID distinguishedName
---- --- -----------------
Administrators S-1-5-32-544 CN=Administrators,CN=Builtin,DC=domain,DC=com
Domain Admins S-1-5-21-1234567890-1234567890-1234567890-512 CN=Domain Admins,CN=Users,DC=domain,DC=com
Domain Controllers S-1-5-21-1234567890-1234567890-1234567890-516 CN=Domain Controllers,CN=Users,DC=domain,DC=com
Enterprise Admins S-1-5-21-1234567890-1234567890-1234567890-519 CN=Enterprise Admins,CN=Users,DC=domain,DC=com
Read-only Domain Controllers S-1-5-21-1234567890-1234567890-1234567890-521 CN=Read-only Domain Controllers,CN=Users,DC=domain,DC=com
Replicator S-1-5-32-552 CN=Replicator,CN=Builtin,DC=domain,DC=com
Schema Admins S-1-5-21-1234567890-1234567890-1234567890-518 CN=Schema Admins,CN=Users,DC=domain,DC=com
Excluded Groups:
Name SID distinguishedName
---- --- -----------------
Account Operators S-1-5-32-548 CN=Account Operators,CN=Builtin,DC=domain,DC=com
Server Operators S-1-5-32-549 CN=Server Operators,CN=Builtin,DC=domain,DC=com
Print Operators S-1-5-32-550 CN=Print Operators,CN=Builtin,DC=domain,DC=com
Backup Operators S-1-5-32-551 CN=Backup Operators,CN=Builtin,DC=domain,DC=com
The command disables protection by AdminSDHolder container for Account Operators group.
Disable-sthAdminSDHolderGroupProtection -AccountOperators -Disable -YesDisableCurrent dsHeuristics value: null
DISABLED: Account Operators
Resulting dsHeuristics value: 0000000001000001
The command disables protection by AdminSDHolder container for Account Operators, Server Operators, Print Operators and Backup Operators groups.
Disable-sthAdminSDHolderGroupProtection -AccountOperators -ServerOperators -PrintOperators -BackupOperators -Disable -YesDisableCurrent dsHeuristics value: null
DISABLED: Account Operators
DISABLED: Server Operators
DISABLED: Print Operators
DISABLED: Backup Operators
Resulting dsHeuristics value: 000000000100000f
The command enables protection by AdminSDHolder container for Account Operators group.
Enable-sthAdminSDHolderGroupProtection -AccountOperators -Enable -YesEnableCurrent dsHeuristics value: 000000000100000f
ENABLED: Account Operators
Resulting dsHeuristics value: 000000000100000e
The command enables protection by AdminSDHolder container for Account Operators, Server Operators, Print Operators and Backup Operators groups.
Enable-sthAdminSDHolderGroupProtection -AccountOperators -ServerOperators -PrintOperators -BackupOperators -Enable -YesEnableCurrent dsHeuristics value: 000000000100000f
ENABLED: Account Operators
ENABLED: Server Operators
ENABLED: Print Operators
ENABLED: Backup Operators
Resulting dsHeuristics value: 0000000001000000