Controlling Access to Active Directory Objects

Every object in Active Directory™ is protected by Windows® 2000 security. This security protection controls the operations that each security principal can perform in the directory. This chapter includes the following sections that discuss how a directory-enabled application can cope with and take advantage of the access control features of Active Directory.

• An overview of access control in Active Directory
• How access control affects read operations, write operation, object creation and deletion.
• Using the IADs and IDirectoryObject interfaces to work with an object's security descriptor
• Modifying the access permissions on an object
• How security descriptors are set on new directory objects
• Creating a security descriptor
• Using inheritance of access permissions to enable administrative access to an entire subtree of the directory
• Creating, modifying, and reading the default security descriptor for an object class
• Creating, setting, and checking extended rights for operations that go beyond those covered by the predefined rights