[ActiveDir] Hiding in the Directory

[Noah Eiger]

I have been asked by a company to help them tighten what is currently a very loose security model. Now, several non-IT-but-computer-adept employees have accounts with full Domain Admin privileges. Many of these folks are programmer types and pretty savvy (which leads them to think they know what they are doing – that’s another story). They are also aware that we are going to tighten things down. For political reasons, we could not just yank their admin access.   So the question is: if you were one of these folks and were inclined to mischief (or simply ensuring your continued access), how might you hide yourself in the Directory? More to the point: where should I look beyond the obvious group memberships?   Thanks.   -- nme -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 267.15.5/256 - Release Date: 2/10/2006