Hi IT Consultants,
I was reading MMAD user guide. I have few questions regarding Security Descriptor migration by ADPW. As per user guide,
Security Descriptor migration rule—Select the way security descriptors of the matched source and target objects will be handled. All objects in Active Directory are securable objects. Each securable object has a security descriptor (SD) that identifies the object’s owner and can also contain the following access control lists:
A discretionary access control list (DACL) that identifies the users and groups allowed or denied access to the object
A system access control list (SACL) that controls how the system audits attempts to access the object
An ACL contains a list of access control entries (ACEs). Each ACE in an ACL identifies a trustee (a user account or group account) by its SID and specifies the access rights allowed, denied, or audited for that trustee. You have the opportunity to Merge, Replace, or Skip the security descriptors:
Merge—The security descriptor entries of the source object will be added to the security descriptor of the target object.
Skip—The security descriptor of the target object will be left intact.
Replace—All entries of the target object’s security descriptor will be deleted. The entries of the source object’ security descriptor will be copied to the target object’s security descriptor.
The DACL and SACL security descriptor entries of the source objects are assigned to the newly-created target objects during migration. Regardless of the option you select to migrate security descriptors (Merge, Skip, or Replace) for each newly created target object, the default security descriptor defined for that object class will also be applied.
NOTE:Only ACEs explicitly added to the source security descriptor are migrated. The inheritance flag (the Allow inheritable permissions from parent to propagate to this object option on the Security tab of the object Properties) is migrated as well. That is, if the inheritance flag is set for the source object, it will be set for the corresponding target object; if the inheritance flag is not set for the source object, it will be cleared from the corresponding target object.
During migration, the ACEs of the source security descriptor referencing the source objects (source SIDs) are not translated to the target objects (target SIDs). To translate or clean up the source objects’ SIDs migrated to the target object’s security descriptor, use the Active Directory Processing Wizard. Add SIDHistory—Select this checkbox if you want to allow the target accounts to access the source domain resources using the SIDHistory mechanism during the coexistence period. For more information on SIDHistory adding, see Adding SID History.
So my questions are:
Q1: If I choose Merge, then SD entries of both source and migrated target objects will be appearing. Then why do I need to process by ADPW if SD entries of the migrated target object are already showing?
Q2: How does ADPW process under Skip method if there are no Source object SD entries in migrated target object?
Q3: How does ADPW process under Replace method?
Q3: Do I only need to process Security Descriptors only for migrated target objects and only in target domain? Can I process SD by ADPW in both mode (Append or Replace)?
Please answer and explain specific to questions.
Thanks in advance!
