|
Hey
Brad,
Although it is still considered a best-practice, from a security
standpoint, an empty root doesn't buy you anything. It is still possible for a
"rogue" domain admin to escalate their privelege level and compromise the
Configuration and Schema NCs, for instance. See Design Considerations for Delegation of
Admininistration in Active Directory:
"Note that a
dedicated forest root only provides protection against accidental or unintended
misuse of privilege; owners of non-root domains can still use malicious methods
to attempt to manipulate groups in the root domain."
-gil
|
Title: Message
- [ActiveDir] Security Domain Brad Martin
- Gil Kirkpatrick
