将 Active Directory 对象标记为“只读”？
昨天我们度过了糟糕的一天。 我们的一位域管理员删除了一个包含 700 多个用户和相同数量的计算机的 OU，以及其他各种有用的东西，例如组等。
我们从备份中恢复，但这并不完美。
我知道 ADUC 会询问您是否确定等...但如果不进入 ADSIEdit 之类的东西将其设置为“允许”删除，从而不允许人们删除该特定 OU，我希望它删除而不实际打开新应用程序并特别指出“是 - 我知道我在做什么”。 这将具有阻止意外错误编码删除关键 AD 对象的额外好处。
你们能想到这样的属性或方法吗？
We had a bad day yesterday. One of our Domain Admins deleted an OU containing 700+ users and the same amount of computers as well as assorted other useful things like groups etc.
We restored from a backup, but it wasn't pretty.
I know that ADUC asks you if you're sure etc... but I'd like it if it was not possible to delete this particular OU without going into something like ADSIEdit to set it "allowable" for deletion - thereby not allowing people to delete without actually opening a new app and specifically indicating that "YES - I know what I'm doing". This would have the added benefit of stopping accidental miscoding from deleting critical AD objects.
Any such attribute or method that you folks could think of?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Win2k3及更高版本的AD中有一个功能可以标记对象以防止意外删除。 对象上的此复选框实际上会更改基础权限，以便您删除删除权限。 因此，它不是特定于工具的，必须受到其他工具（如 powershell 和 vbscript）的尊重。
There is a feature in AD for Win2k3 and higher to mark an object to prevent accidental deletion. This check box on the object actually changes the underlying permissions for you to remove delete permissions. Therefore it is not tool specific and must be respected by other tools (like powershell and vbscript).
只需删除那些无法正确删除内容的权限即可。 您可以在 AD 中授予非常细粒度的权限。
没有“只读”属性。 这就是 ACL 的用途。
Simply remove the permission to delete things from those unable to get it right. You can give very fine-grained permissions in AD.
There is no "readonly" attribute. That's what the ACLs are for.
您可以通过根级别的委派拒绝管理员的删除权限，然后您需要成为企业管理员才能执行删除。 确保企业管理员组中没有管理员进行日常使用。
You could deny the Delete privalge from Administrators through Delegation at the root level and then you would need to be an enterprise admin to perform deletions. Ensure that no admins are in the Enterprise Admins group for day-to-day usage.