The Keys to the Kingdom: Limiting Active Directory Administrators

The practice of allowing data center server operators to be Active Directory domain administrators is the most common—and the most potentially damaging—security risk in the Active Directory infrastructure. The challenge for the Active Directory administrator is to adequately secure their directory, while still delegating enough domain controller administration rights to allow effective daily operations. This white paper explains the domain controller security model and the security risks associated with simple implementations of the model—and presents best practices for separating the role of domain controller administration from domain administration using native tools.