An ADSI Primer, Part 10: Permissions and Auditing Basics

Editor's Note: This article is the 10th part of a 12-part series about Active Directory Service Interfaces (ADSI). The series started in the January 1999 issue. Refer to previous installments for definitions and background information.

Controlling permissions in the Windows 2000 (Win2K) Active Directory (AD) is crucial to your network's security. Although you might not care if everyone can access your users' telephone numbers, you might want to restrict access to more sensitive information. In addition, you might need to create, modify, or delete privileges to prevent malevolent or mischievous employees from, for example, deleting all the users in an organizational unit (OU) in the AD store.

Auditing permission modifications is just as crucial to your network's security. In Win2K, auditing is a process in which the system logs AD events in the Security event log on a particular domain controller. Thus, you can monitor any modification to the AD store, including modifications to permissions. . . .