ACL ACL in Active Directory & LDAP 1 — Questions and Answers
Question 1: In Active Directory, what is an Access Control Entry (ACE)?
- A certificate used to authenticate domain users
- An individual permission rule specifying a trustee and the access rights granted or denied (Correct answer)
- A Group Policy Object that controls login permissions
- A Kerberos ticket granting access to domain resources
Correct answer: An individual permission rule specifying a trustee and the access rights granted or denied
An ACE is a single entry within an ACL that identifies a trustee (user, group, or computer) and specifies which access rights are allowed or denied for that trustee.
Question 2: Which tool and setting must be enabled to view and edit ACLs on Active Directory objects?
- Active Directory Users and Computers with Advanced Features enabled (Correct answer)
- Group Policy Management Console
- Windows Defender Firewall
- Event Viewer
Correct answer: Active Directory Users and Computers with Advanced Features enabled
Enabling 'Advanced Features' under the View menu in ADUC exposes the Security tab, allowing administrators to view and modify ACLs on Active Directory objects.
Question 3: What is AdminSDHolder in Active Directory?
- A service account with domain admin privileges
- A protected container object whose ACL is periodically applied to privileged accounts and groups (Correct answer)
- A group policy that prevents modification of admin accounts
- A backup domain controller for administrative functions
Correct answer: A protected container object whose ACL is periodically applied to privileged accounts and groups
AdminSDHolder is a special AD container whose ACL is automatically propagated to all protected accounts (such as Domain Admins members) by the SDProp process every 60 minutes.
Question 4: In LDAP implementations, where is access control information typically stored for directory entries?
- In the cn attribute
- In the objectClass attribute
- In a standard user attribute called aclRights
- In operational attributes such as `aci` or `entryACI` (Correct answer)
Correct answer: In operational attributes such as `aci` or `entryACI`
LDAP servers such as OpenLDAP and 389 Directory Server store access control information in server-specific operational attributes like `aci` or `entryACI` rather than standard visible attributes.
Question 5: What Active Directory permission allows a user to create new objects within an Organizational Unit?
- Read
- Write
- Create Child Objects (Correct answer)
- Full Control
Correct answer: Create Child Objects
The 'Create Child Objects' permission grants the right to create new objects such as users, groups, and computers within an OU or container.
Question 6: What is ACL-based delegation in Active Directory?
- Assigning domain admin rights to helpdesk staff
- Granting specific, limited permissions on AD objects to non-admin users for defined administrative tasks (Correct answer)
- Delegating Kerberos authentication to a service account
- Transferring FSMO roles between domain controllers
Correct answer: Granting specific, limited permissions on AD objects to non-admin users for defined administrative tasks
ACL-based delegation allows administrators to grant non-privileged users specific rights on particular OUs — such as resetting passwords — without granting full administrative access.
ACL ACL in Active Directory & LDAP 1
In Active Directory, what is an Access Control Entry (ACE)?