?
Solved

Locking Down the AD, How do you remove DELETE

Posted on 2006-05-24
8
Medium Priority
?
267 Views
Last Modified: 2012-05-05
Hello,

I had a major issue last night, one of my administrators deleted close to 2000 accounts. How can I remove the ability for all administrators to DELETE anything and just give all AD Control to a seperate Group ??

I looked at Delegate Control but Add and Delete where in the same area... I just want to remove delete.

Thanks
Josh
0
Comment
Question by:dgriffit55
  • 2
  • 2
  • 2
  • +1
8 Comments
 
LVL 23

Expert Comment

by:TheCleaner
ID: 16750949
Josh,

I don't really know the answer to this, maybe another EE expert will.  However, I would suggest you download Quest's free Object Restore for AD :  http://www.quest.com/object_restore_for_active_directory/

It gives you a nice easy to use GUI to recover deleted AD items (based on tombstoning).

Makes it much less of a "CRAP!!!" situation when a rogue admin deletes something they shouldn't have.
0
 
LVL 16

Expert Comment

by:mdiglio
ID: 16751109
Hello,
If you open AD Users and computers > click 'View' > make sure 'Advanced Features' is checked
Now you can right click on an OU or the domain root and select properties > click the 'security' tab

Here you can can look at the permissions and change them if necessary
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16756478
Hi dgriffit55,

if you have some tool of an admin running around, i would piss off his access to AD full stop, add and delete are part of the same delegated task but he doesnt deserve access to either. I doubt it was a mistake...its kind of hard to mistakingly delete 2000 accounts, have you got a backup you can restore from?
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 

Author Comment

by:dgriffit55
ID: 16760840
Hi Jay Jay,

I have Veritas 10d however I was not able to restore just the AD. It wanted to restore the complete system state, I am currently talking to Veritas to find out why I could not do that. I am not sure if I should be using a different AD Backup tool or not.

Thanks
Josh
0
 
LVL 16

Expert Comment

by:mdiglio
ID: 16760978
Have you looked at TheCleaner's recommendation?
Here are more articles concerning restoring AD objects but I would try his suggestion first.

How to restore deleted user accounts and their group memberships in Active Directory
http://support.microsoft.com/?kbid=840001

ADRestore
http://www.sysinternals.com/Utilities/AdRestore.html
0
 

Author Comment

by:dgriffit55
ID: 16761714
Hi Mdiglio,

This is great info, however is their any easy Backup / Restore programs that you would suggest for AD ?

Josh
0
 
LVL 23

Accepted Solution

by:
TheCleaner earned 500 total points
ID: 16761902
If BE 10d is installed locally:  http://support.veritas.com/docs/236240

If BE 10d is installed remotely:  http://support.veritas.com/docs/236286

More info:  http://support.veritas.com/docs/236661


Be careful.  I would suggest trying the Quest Object Restore first just in case the records are still tombstoned.
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 16762283
veritas is usually pretty reliable, but i would follow TheCleaners advice with this, i havent used the tool, but am wise enough to know, that if he suggests it, give it a go
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?
There may be issues when you are trying to access Outlook or send & receive emails or due to Outlook crash which leads to corrupt or damaged PST file. To eliminate the corruption from your PST file, you need to repair the corrupt Outlook PST file. U…

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question