source4/setup/extended-rights.ldif

   1 # This is the schema of the extended rights built in to Active Directory
   2 #
   3 # This file is needed to document the rights that are available and to
   4 # create the appropritate objects in the AD database, which are used
   5 # by the administrative tools.
   6 #
   7 # The primary source is MS-ADTS 12/1/2017 v47.0 under 6.1.1.2.7
   8 # That document is licenced thusly:
   9 #
  10 # Intellectual Property Rights Notice for Open Specifications Documentation
  11 #
  12
  13 # Technical Documentation. Microsoft publishes Open Specifications
  14 # documentation ("this documentation") for protocols, file formats,
  15 # data portability, computer languages, and standards
  16 # support. Additionally, overview documents cover inter-protocol
  17 # relationships and interactions.
  18
  19 # Copyrights. This documentation is covered by Microsoft
  20 # copyrights. Regardless of any other terms that are contained in the
  21 # terms of use for the Microsoft website that hosts this
  22 # documentation, you can make copies of it in order to develop
  23 # implementations of the technologies that are described in this
  24 # documentation and can distribute portions of it in your
  25 # implementations that use these technologies or in your documentation
  26 # as necessary to properly document the implementation. You can also
  27 # distribute in your implementation, with or without modification, any
  28 # schemas, IDLs, or code samples that are included in the
  29 # documentation. This permission also applies to any documents that
  30 # are referenced in the Open Specifications documentation.
  31
  32 # No Trade Secrets. Microsoft does not claim any trade secret rights
  33 # in this documentation.
  34
  35 # Patents. Microsoft has patents that might cover your implementations
  36 # of the technologies described in the Open Specifications
  37 # documentation. Neither this notice nor Microsoft's delivery of this
  38 # documentation grants any licenses under those patents or any other
  39 # Microsoft patents. However, a given Open Specifications document
  40 # might be covered by the Microsoft Open Specifications Promise or the
  41 # Microsoft Community Promise. If you would prefer a written license,
  42 # or if the technologies described in this documentation are not
  43 # covered by the Open Specifications Promise or Community Promise, as
  44 # applicable, patent licenses are available by contacting
  45 # iplg@microsoft.com.
  46
  47 # License Programs. To see all of the protocols in scope under a
  48 # specific license program and the associated patents, visit the
  49 # Patent Map.
  50
  51 # Trademarks. The names of companies and products contained in this
  52 # documentation might be covered by trademarks or similar intellectual
  53 # property rights. This notice does not grant any licenses under those
  54 # rights. For a list of Microsoft trademarks, visit
  55 # www.microsoft.com/trademarks.
  56
  57 # Fictitious Names. The example companies, organizations, products,
  58 # domain names, email addresses, logos, people, places, and events
  59 # that are depicted in this documentation are fictitious. No
  60 # association with any real company, organization, product, domain
  61 # name, email address, logo, person, place, or event is intended or
  62 # should be inferred.
  63
  64 # Reservation of Rights. All other rights are reserved, and this
  65 # notice does not grant any rights other than as specifically
  66 # described above, whether by implication, estoppel, or otherwise.
  67
  68 # Tools. The Open Specifications documentation does not require the
  69 # use of Microsoft programming tools or programming environments in
  70 # order for you to develop an implementation. If you have access to
  71 # Microsoft programming tools and environments, you are free to take
  72 # advantage of them. Certain Open Specifications documents are
  73 # intended for use in conjunction with publicly available standards
  74 # specifications and network programming art and, as such, assume that
  75 # the reader either is familiar with the aforementioned material or
  76 # has immediate access to it.
  77
  78 # Support. For questions and support, please contact dochelp@microsoft.com.
  79
  80 #
  81 # Additionally, changes for Windows 2012 and above are sourced from
  82 #
  83 # https://github.com/MicrosoftDocs/windowsserverdocs/blob/master/WindowsServerDocs/identity/ad-ds/deploy/Schema-Updates.md
  84 #
  85 # in this repoo this is kept in
  86 # source4/setup/adprep/WindowsServerDocs/Schema-Updates.md
  87 # and is licenced under the MIT licence
  88 #
  89 # The MIT License (MIT)
  90 #  Copyright (c) Microsoft Corporation
  91
  92 # Permission is hereby granted, free of charge, to any person
  93 # obtaining a copy of this software and associated documentation files
  94 # (the "Software"), to deal in the Software without restriction,
  95 # including without limitation the rights to use, copy, modify, merge,
  96 # publish, distribute, sublicense, and/or sell copies of the Software,
  97 # and to permit persons to whom the Software is furnished to do so,
  98 # subject to the following conditions:
  99
 100 # The above copyright notice and this permission notice shall be
 101 # included in all copies or substantial portions of the Software.
 102
 103 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 104 # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 105 # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 106 # IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 107 # CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 108 # TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 109 # SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 110 #
 111
 112 # 6.1.1.2.7.1 controlAccessRight objects
 113 # All controlAccessRight objects have:
 114 # objectClass: controlAccessRight
 115 # rightsGuid: This value is the identifier of the control access right
 116 #             used for security descriptors and SDDL.
 117 # appliesTo: Each value in this attribute is a GUID, with each GUID
 118 #            equaling an attribute schemaIDGUID on a schema object
 119 #            defining a class in the schema NC. This class defines the
 120 #            objects in which the control access right can be a
 121 #            security descriptor for. The appliesTo values on the
 122 #            controlAccessRight are not enforced by the directory
 123 #            server; that is, the controlAccessRight can be included
 124 #            in security descriptors of objects of classes not
 125 #            specified in the appliesTo attribute.
 126 # localizationDisplayId: This is implementation-specific information
 127 #                        for the administrative application.
 128 # validAccesses: This is implementation-specific information for the
 129 #                administrative application.
 130 #
 131 # NOTE: while it is claimed that validAccesses is implementation-specfic
 132 # it can be determined by careful reading of other parts of MS-ADTS
 133
 134 dn: CN=Change-Rid-Master,CN=Extended-Rights,${CONFIGDN}
 135 objectClass: top
 136 objectClass: controlAccessRight
 137 displayName: Change Rid Master
 138 rightsGuid: d58d5f36-0a98-11d1-adbb-00c04fd8d5cd
 139 appliesTo: 6617188d-8f3c-11d0-afda-00c04fd930c9
 140 validAccesses: 256
 141
 142 dn: CN=Do-Garbage-Collection,CN=Extended-Rights,${CONFIGDN}
 143 objectClass: top
 144 objectClass: controlAccessRight
 145 displayName: Do Garbage Collection
 146 rightsGuid: fec364e0-0a98-11d1-adbb-00c04fd8d5cd
 147 appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
 148 validAccesses: 256
 149
 150 dn: CN=Recalculate-Hierarchy,CN=Extended-Rights,${CONFIGDN}
 151 objectClass: top
 152 objectClass: controlAccessRight
 153 displayName: Recalculate Hierarchy
 154 rightsGuid: 0bc1554e-0a99-11d1-adbb-00c04fd8d5cd
 155 appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
 156 validAccesses: 256
 157
 158 dn: CN=Allocate-Rids,CN=Extended-Rights,${CONFIGDN}
 159 objectClass: top
 160 objectClass: controlAccessRight
 161 displayName: Allocate Rids
 162 rightsGuid: 1abd7cf8-0a99-11d1-adbb-00c04fd8d5cd
 163 appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
 164 validAccesses: 256
 165
 166 dn: CN=Change-PDC,CN=Extended-Rights,${CONFIGDN}
 167 objectClass: top
 168 objectClass: controlAccessRight
 169 displayName: Change PDC
 170 rightsGuid: bae50096-4752-11d1-9052-00c04fc2d4cf
 171 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 172 validAccesses: 256
 173
 174 dn: CN=Add-GUID,CN=Extended-Rights,${CONFIGDN}
 175 objectClass: top
 176 objectClass: controlAccessRight
 177 displayName: Add GUID
 178 rightsGuid: 440820ad-65b4-11d1-a3da-0000f875ae0d
 179 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 180 validAccesses: 256
 181
 182 dn: CN=Change-Domain-Master,CN=Extended-Rights,${CONFIGDN}
 183 objectClass: top
 184 objectClass: controlAccessRight
 185 displayName: Change Domain Master
 186 rightsGuid: 014bf69c-7b3b-11d1-85f6-08002be74fab
 187 appliesTo: ef9e60e0-56f7-11d1-a9c6-0000f80367c1
 188 validAccesses: 256
 189
 190 dn: CN=Public-Information,CN=Extended-Rights,${CONFIGDN}
 191 objectClass: top
 192 objectClass: controlAccessRight
 193 displayName: Public Information
 194 rightsGuid: e48d0154-bcf8-11d1-8702-00c04fb96050
 195 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 196 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 197 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 198 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 199 validAccesses: 48
 200
 201 dn: CN=msmq-Receive-Dead-Letter,CN=Extended-Rights,${CONFIGDN}
 202 objectClass: top
 203 objectClass: controlAccessRight
 204 displayName: msmq Receive Dead Letter
 205 rightsGuid: 4b6e08c0-df3c-11d1-9c86-006008764d0e
 206 appliesTo: 9a0dc344-c100-11d1-bbc5-0080c76670c0
 207 validAccesses: 256
 208
 209 dn: CN=msmq-Peek-Dead-Letter,CN=Extended-Rights,${CONFIGDN}
 210 objectClass: top
 211 objectClass: controlAccessRight
 212 displayName: msmq Peek Dead Letter
 213 rightsGuid: 4b6e08c1-df3c-11d1-9c86-006008764d0e
 214 appliesTo: 9a0dc344-c100-11d1-bbc5-0080c76670c0
 215 validAccesses: 256
 216
 217 dn: CN=msmq-Receive-computer-Journal,CN=Extended-Rights,${CONFIGDN}
 218 objectClass: top
 219 objectClass: controlAccessRight
 220 displayName: msmq Receive computer Journal
 221 rightsGuid: 4b6e08c2-df3c-11d1-9c86-006008764d0e
 222 appliesTo: 9a0dc344-c100-11d1-bbc5-0080c76670c0
 223 validAccesses: 256
 224
 225 dn: CN=msmq-Peek-computer-Journal,CN=Extended-Rights,${CONFIGDN}
 226 objectClass: top
 227 objectClass: controlAccessRight
 228 displayName: msmq Peek computer Journal
 229 rightsGuid: 4b6e08c3-df3c-11d1-9c86-006008764d0e
 230 appliesTo: 9a0dc344-c100-11d1-bbc5-0080c76670c0
 231 validAccesses: 256
 232
 233 dn: CN=msmq-Receive,CN=Extended-Rights,${CONFIGDN}
 234 objectClass: top
 235 objectClass: controlAccessRight
 236 displayName: msmq Receive
 237 rightsGuid: 06bd3200-df3e-11d1-9c86-006008764d0e
 238 appliesTo: 9a0dc343-c100-11d1-bbc5-0080c76670c0
 239 validAccesses: 256
 240
 241 dn: CN=msmq-Peek,CN=Extended-Rights,${CONFIGDN}
 242 objectClass: top
 243 objectClass: controlAccessRight
 244 displayName: msmq Peek
 245 rightsGuid: 06bd3201-df3e-11d1-9c86-006008764d0e
 246 appliesTo: 9a0dc343-c100-11d1-bbc5-0080c76670c0
 247 validAccesses: 256
 248
 249 dn: CN=msmq-Send,CN=Extended-Rights,${CONFIGDN}
 250 objectClass: top
 251 objectClass: controlAccessRight
 252 displayName: msmq Send
 253 rightsGuid: 06bd3202-df3e-11d1-9c86-006008764d0e
 254 appliesTo: 9a0dc343-c100-11d1-bbc5-0080c76670c0
 255 appliesTo: 46b27aac-aafa-4ffb-b773-e5bf621ee87b
 256 validAccesses: 256
 257
 258 dn: CN=msmq-Receive-journal,CN=Extended-Rights,${CONFIGDN}
 259 objectClass: top
 260 objectClass: controlAccessRight
 261 displayName: msmq Receive journal
 262 rightsGuid: 06bd3203-df3e-11d1-9c86-006008764d0e
 263 appliesTo: 9a0dc343-c100-11d1-bbc5-0080c76670c0
 264 validAccesses: 256
 265
 266 dn: CN=msmq-Open-Connector,CN=Extended-Rights,${CONFIGDN}
 267 objectClass: top
 268 objectClass: controlAccessRight
 269 displayName: msmq Open Connector
 270 rightsGuid: b4e60130-df3f-11d1-9c86-006008764d0e
 271 appliesTo: bf967ab3-0de6-11d0-a285-00aa003049e2
 272 validAccesses: 256
 273
 274 dn: CN=Apply-Group-Policy,CN=Extended-Rights,${CONFIGDN}
 275 objectClass: top
 276 objectClass: controlAccessRight
 277 displayName: Apply Group Policy
 278 rightsGuid: edacfd8f-ffb3-11d1-b41d-00a0c968f939
 279 appliesTo: f30e3bc2-9ff0-11d1-b603-0000f80367c1
 280 validAccesses: 256
 281
 282 dn: CN=RAS-Information,CN=Extended-Rights,${CONFIGDN}
 283 objectClass: top
 284 objectClass: controlAccessRight
 285 displayName: Remote Access Information
 286 rightsGuid: 037088f8-0ae1-11d2-b422-00a0c968f939
 287 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 288 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 289 validAccesses: 48
 290
 291 dn: CN=DS-Install-Replica,CN=Extended-Rights,${CONFIGDN}
 292 objectClass: top
 293 objectClass: controlAccessRight
 294 displayName: DS Install Replica
 295 rightsGuid: 9923a32a-3607-11d2-b9be-0000f87a36b2
 296 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 297 validAccesses: 256
 298
 299 dn: CN=Change-Infrastructure-Master,CN=Extended-Rights,${CONFIGDN}
 300 objectClass: top
 301 objectClass: controlAccessRight
 302 displayName: Change Infrastructure Master
 303 rightsGuid: cc17b1fb-33d9-11d2-97d4-00c04fd8d5cd
 304 appliesTo: 2df90d89-009f-11d2-aa4c-00c04fd7d83a
 305 validAccesses: 256
 306
 307 dn: CN=Update-Schema-Cache,CN=Extended-Rights,${CONFIGDN}
 308 objectClass: top
 309 objectClass: controlAccessRight
 310 displayName: Update Schema Cache
 311 rightsGuid: be2bb760-7f46-11d2-b9ad-00c04f79f805
 312 appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
 313 validAccesses: 256
 314
 315 dn: CN=Recalculate-Security-Inheritance,CN=Extended-Rights,${CONFIGDN}
 316 objectClass: top
 317 objectClass: controlAccessRight
 318 displayName: Recalculate Security Inheritance
 319 rightsGuid: 62dd28a8-7f46-11d2-b9ad-00c04f79f805
 320 appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
 321 validAccesses: 256
 322
 323 dn: CN=DS-Check-Stale-Phantoms,CN=Extended-Rights,${CONFIGDN}
 324 objectClass: top
 325 objectClass: controlAccessRight
 326 displayName: DS Check Stale Phantoms
 327 rightsGuid: 69ae6200-7f46-11d2-b9ad-00c04f79f805
 328 appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
 329 validAccesses: 256
 330
 331 dn: CN=Certificate-Enrollment,CN=Extended-Rights,${CONFIGDN}
 332 objectClass: top
 333 objectClass: controlAccessRight
 334 displayName: Certificate Enrollment
 335 rightsGuid: 0e10c968-78fb-11d2-90d4-00c04f79dc55
 336 appliesTo: e5209ca2-3bba-11d2-90cc-00c04fd91ab1
 337 validAccesses: 256
 338
 339 dn: CN=Self-Membership,CN=Extended-Rights,${CONFIGDN}
 340 objectClass: top
 341 objectClass: controlAccessRight
 342 displayName: Self Membership
 343 rightsGuid: bf9679c0-0de6-11d0-a285-00aa003049e2
 344 appliesTo: bf967a9c-0de6-11d0-a285-00aa003049e2
 345 validAccesses: 8
 346
 347 dn: CN=Validated-DNS-Host-Name,CN=Extended-Rights,${CONFIGDN}
 348 objectClass: top
 349 objectClass: controlAccessRight
 350 displayName: Validated DNS Host Name
 351 rightsGuid: 72e39547-7b18-11d1-adef-00c04fd8d5cd
 352 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 353 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 354 ${INC2012}appliesTo: 7b8b558a-93a5-4af7-adca-c017e67f1057
 355 validAccesses: 8
 356
 357 dn: CN=Validated-SPN,CN=Extended-Rights,${CONFIGDN}
 358 objectClass: top
 359 objectClass: controlAccessRight
 360 displayName: Validated SPN
 361 rightsGuid: f3a64788-5306-11d1-a9c5-0000f80367c1
 362 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 363 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 364 validAccesses: 8
 365
 366 dn: CN=Generate-RSoP-Planning,CN=Extended-Rights,${CONFIGDN}
 367 objectClass: top
 368 objectClass: controlAccessRight
 369 displayName: Generate RSoP Planning
 370 rightsGuid: b7b1b3dd-ab09-4242-9e30-9980e5d322f7
 371 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 372 appliesTo: bf967aa5-0de6-11d0-a285-00aa003049e2
 373 validAccesses: 256
 374
 375 dn: CN=Refresh-Group-Cache,CN=Extended-Rights,${CONFIGDN}
 376 objectClass: top
 377 objectClass: controlAccessRight
 378 displayName: Refresh Group Cache
 379 rightsGuid: 9432c620-033c-4db7-8b58-14ef6d0bf477
 380 appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
 381 validAccesses: 256
 382
 383 dn: CN=Reload-SSL-Certificate,CN=Extended-Rights,${CONFIGDN}
 384 objectClass: top
 385 objectClass: controlAccessRight
 386 displayName: Reload SSL Certificate
 387 rightsGuid: 1a60ea8d-58a6-4b20-bcdc-fb71eb8a9ff8
 388 appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
 389 validAccesses: 256
 390
 391 dn: CN=SAM-Enumerate-Entire-Domain,CN=Extended-Rights,${CONFIGDN}
 392 objectClass: top
 393 objectClass: controlAccessRight
 394 displayName: SAM Enumerate Entire Domain
 395 rightsGuid: 91d67418-0135-4acc-8d79-c08e857cfbec
 396 appliesTo: bf967aad-0de6-11d0-a285-00aa003049e2
 397 validAccesses: 256
 398
 399 dn: CN=Generate-RSoP-Logging,CN=Extended-Rights,${CONFIGDN}
 400 objectClass: top
 401 objectClass: controlAccessRight
 402 displayName: Generate RSoP Logging
 403 rightsGuid: b7b1b3de-ab09-4242-9e30-9980e5d322f7
 404 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 405 appliesTo: bf967aa5-0de6-11d0-a285-00aa003049e2
 406 validAccesses: 256
 407
 408 dn: CN=Domain-Other-Parameters,CN=Extended-Rights,${CONFIGDN}
 409 objectClass: top
 410 objectClass: controlAccessRight
 411 displayName: Other Domain Parameters (for use by SAM)
 412 rightsGuid: b8119fd0-04f6-4762-ab7a-4986c76b3f9a
 413 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 414 validAccesses: 48
 415
 416 dn: CN=DNS-Host-Name-Attributes,CN=Extended-Rights,${CONFIGDN}
 417 objectClass: top
 418 objectClass: controlAccessRight
 419 displayName: DNS Host Name Attributes
 420 rightsGuid: 72e39547-7b18-11d1-adef-00c04fd8d5cd
 421 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 422 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 423 ${INC2012}appliesTo: 7b8b558a-93a5-4af7-adca-c017e67f1057
 424 validAccesses: 48
 425
 426 dn: CN=Create-Inbound-Forest-Trust,CN=Extended-Rights,${CONFIGDN}
 427 objectClass: top
 428 objectClass: controlAccessRight
 429 displayName: Create Inbound Forest Trust
 430 rightsGuid: e2a36dc9-ae17-47c3-b58b-be34c55ba633
 431 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 432 validAccesses: 256
 433
 434 dn: CN=DS-Replication-Get-Changes-All,CN=Extended-Rights,${CONFIGDN}
 435 objectClass: top
 436 objectClass: controlAccessRight
 437 displayName: DS Replication Get Changes All
 438 rightsGuid: 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2
 439 appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
 440 appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
 441 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 442 validAccesses: 256
 443
 444 dn: CN=Migrate-SID-History,CN=Extended-Rights,${CONFIGDN}
 445 objectClass: top
 446 objectClass: controlAccessRight
 447 displayName: Migrate SID History
 448 rightsGuid: BA33815A-4F93-4c76-87F3-57574BFF8109
 449 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 450 validAccesses: 256
 451
 452 dn: CN=Reanimate-Tombstones,CN=Extended-Rights,${CONFIGDN}
 453 objectClass: top
 454 objectClass: controlAccessRight
 455 displayName: Reanimate Tombstones
 456 rightsGuid: 45EC5156-DB7E-47bb-B53F-DBEB2D03C40F
 457 appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
 458 appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
 459 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 460 validAccesses: 256
 461
 462 dn: CN=Allowed-To-Authenticate,CN=Extended-Rights,${CONFIGDN}
 463 objectClass: top
 464 objectClass: controlAccessRight
 465 displayName: Allowed To Authenticate
 466 rightsGuid: 68B1D179-0D15-4d4f-AB71-46152E79A7BC
 467 appliesTo: 4828cc14-1437-45bc-9b07-ad6f015e5f28
 468 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 469 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 470 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 471 validAccesses: 256
 472
 473 dn: CN=DS-Execute-Intentions-Script,CN=Extended-Rights,${CONFIGDN}
 474 objectClass: top
 475 objectClass: controlAccessRight
 476 displayName: DS Execute Intentions Script
 477 rightsGuid: 2f16c4a5-b98e-432c-952a-cb388ba33f2e
 478 appliesTo: ef9e60e0-56f7-11d1-a9c6-0000f80367c1
 479 validAccesses: 256
 480
 481 dn: CN=DS-Replication-Monitor-Topology,CN=Extended-Rights,${CONFIGDN}
 482 objectClass: top
 483 objectClass: controlAccessRight
 484 displayName: DS Replication Monitor Topology
 485 rightsGuid: f98340fb-7c5b-4cdb-a00b-2ebdfa115a96
 486 appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
 487 appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
 488 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 489 validAccesses: 256
 490
 491 dn: CN=Update-Password-Not-Required-Bit,CN=Extended-Rights,${CONFIGDN}
 492 objectClass: top
 493 objectClass: controlAccessRight
 494 displayName: Update Password Not Required Bit
 495 rightsGuid: 280f369c-67c7-438e-ae98-1d46f3c6f541
 496 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 497 validAccesses: 256
 498
 499 dn: CN=Unexpire-Password,CN=Extended-Rights,${CONFIGDN}
 500 objectClass: top
 501 objectClass: controlAccessRight
 502 displayName: Unexpire Password
 503 rightsGuid: ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501
 504 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 505 validAccesses: 256
 506
 507 dn: CN=Enable-Per-User-Reversibly-Encrypted-Password,CN=Extended-Rights,${CONFIGDN}
 508 objectClass: top
 509 objectClass: controlAccessRight
 510 displayName: Enable Per User Reversibly Encrypted Password
 511 rightsGuid: 05c74c5e-4deb-43b4-bd9f-86664c2a7fd5
 512 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 513 validAccesses: 256
 514
 515 dn: CN=DS-Query-Self-Quota,CN=Extended-Rights,${CONFIGDN}
 516 objectClass: top
 517 objectClass: controlAccessRight
 518 displayName: DS Query Self Quota
 519 rightsGuid: 4ecc03fe-ffc0-4947-b630-eb672a8a9dbc
 520 appliesTo: da83fc4f-076f-4aea-b4dc-8f4dab9b5993
 521 validAccesses: 256
 522
 523 dn: CN=Private-Information,CN=Extended-Rights,${CONFIGDN}
 524 objectClass: top
 525 objectClass: controlAccessRight
 526 displayName: Private Information
 527 rightsGuid: 91e647de-d96f-4b70-9557-d63ff4f3ccd8
 528 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 529 appliesTo: 4828cc14-1437-45bc-9b07-ad6f015e5f28
 530 validAccesses: 48
 531
 532 dn: CN=MS-TS-GatewayAccess,CN=Extended-Rights,${CONFIGDN}
 533 objectClass: top
 534 objectClass: controlAccessRight
 535 displayName: MS-TS-GatewayAccess
 536 rightsGuid: ffa6f046-ca4b-4feb-b40d-04dfee722543
 537 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 538 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 539 validAccesses: 48
 540
 541 dn: CN=Terminal-Server-License-Server,CN=Extended-Rights,${CONFIGDN}
 542 objectClass: top
 543 objectClass: controlAccessRight
 544 displayName: Terminal Server License Server
 545 rightsGuid: 5805bc62-bdc9-4428-a5e2-856a0f4c185e
 546 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 547 appliesTo: 4828cc14-1437-45bc-9b07-ad6f015e5f28
 548 validAccesses: 48
 549
 550 dn: CN=Domain-Administer-Server,CN=Extended-Rights,${CONFIGDN}
 551 objectClass: top
 552 objectClass: controlAccessRight
 553 displayName: Domain Administer Server
 554 rightsGuid: ab721a52-1e2f-11d0-9819-00aa0040529b
 555 appliesTo: bf967aad-0de6-11d0-a285-00aa003049e2
 556 validAccesses: 256
 557
 558 dn: CN=User-Change-Password,CN=Extended-Rights,${CONFIGDN}
 559 objectClass: top
 560 objectClass: controlAccessRight
 561 displayName: User Change Password
 562 rightsGuid: ab721a53-1e2f-11d0-9819-00aa0040529b
 563 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 564 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 565 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 566 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 567 validAccesses: 256
 568
 569 dn: CN=User-Force-Change-Password,CN=Extended-Rights,${CONFIGDN}
 570 objectClass: top
 571 objectClass: controlAccessRight
 572 displayName: User Force Change Password
 573 rightsGuid: 00299570-246d-11d0-a768-00aa006e0529
 574 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 575 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 576 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 577 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 578 validAccesses: 256
 579
 580 dn: CN=Send-As,CN=Extended-Rights,${CONFIGDN}
 581 objectClass: top
 582 objectClass: controlAccessRight
 583 displayName: Send As
 584 rightsGuid: ab721a54-1e2f-11d0-9819-00aa0040529b
 585 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 586 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 587 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 588 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 589 validAccesses: 256
 590
 591 dn: CN=Receive-As,CN=Extended-Rights,${CONFIGDN}
 592 objectClass: top
 593 objectClass: controlAccessRight
 594 displayName: Receive As
 595 rightsGuid: ab721a56-1e2f-11d0-9819-00aa0040529b
 596 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 597 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 598 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 599 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 600 validAccesses: 256
 601
 602 dn: CN=Send-To,CN=Extended-Rights,${CONFIGDN}
 603 objectClass: top
 604 objectClass: controlAccessRight
 605 displayName: Send To
 606 rightsGuid: ab721a55-1e2f-11d0-9819-00aa0040529b
 607 appliesTo: bf967a9c-0de6-11d0-a285-00aa003049e2
 608 validAccesses: 256
 609
 610 dn: CN=Domain-Password,CN=Extended-Rights,${CONFIGDN}
 611 objectClass: top
 612 objectClass: controlAccessRight
 613 displayName: Domain Password & Lockout Policies
 614 rightsGuid: c7407360-20bf-11d0-a768-00aa006e0529
 615 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 616 appliesTo: 19195a5a-6da0-11d0-afd3-00c04fd930c9
 617 validAccesses: 48
 618
 619 dn: CN=General-Information,CN=Extended-Rights,${CONFIGDN}
 620 objectClass: top
 621 objectClass: controlAccessRight
 622 displayName: General Information
 623 rightsGuid: 59ba2f42-79a2-11d0-9020-00c04fc2d3cf
 624 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 625 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 626 validAccesses: 48
 627
 628 dn: CN=User-Account-Restrictions,CN=Extended-Rights,${CONFIGDN}
 629 objectClass: top
 630 objectClass: controlAccessRight
 631 displayName: Account Restrictions
 632 rightsGuid: 4c164200-20c0-11d0-a768-00aa006e0529
 633 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 634 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 635 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 636 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 637 ${INC2012}appliesTo: 7b8b558a-93a5-4af7-adca-c017e67f1057
 638 validAccesses: 48
 639
 640 dn: CN=User-Logon,CN=Extended-Rights,${CONFIGDN}
 641 objectClass: top
 642 objectClass: controlAccessRight
 643 displayName: Logon Information
 644 rightsGuid: 5f202010-79a5-11d0-9020-00c04fc2d4cf
 645 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 646 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 647 validAccesses: 48
 648
 649 dn: CN=Membership,CN=Extended-Rights,${CONFIGDN}
 650 objectClass: top
 651 objectClass: controlAccessRight
 652 displayName: Group Membership
 653 rightsGuid: bc0ac240-79a9-11d0-9020-00c04fc2d4cf
 654 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 655 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 656 validAccesses: 48
 657
 658 dn: CN=Open-Address-Book,CN=Extended-Rights,${CONFIGDN}
 659 objectClass: top
 660 objectClass: controlAccessRight
 661 displayName: Open Address Book
 662 rightsGuid: a1990816-4298-11d1-ade2-00c04fd8d5cd
 663 appliesTo: 3e74f60f-3e73-11d1-a9c0-0000f80367c1
 664 validAccesses: 256
 665
 666 dn: CN=Personal-Information,CN=Extended-Rights,${CONFIGDN}
 667 objectClass: top
 668 objectClass: controlAccessRight
 669 displayName: Personal Information
 670 rightsGuid: 77B5B886-944A-11d1-AEBD-0000F80367C1
 671 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 672 appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 673 appliesTo: 5cb41ed0-0e4c-11d0-a286-00aa003049e2
 674 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 675 appliesTo: ce206244-5827-4a86-ba1c-1c0c386c1b64
 676 ${INC2012}appliesTo: 641E87A4-8326-4771-BA2D-C706DF35E35A
 677 validAccesses: 48
 678
 679 dn: CN=Email-Information,CN=Extended-Rights,${CONFIGDN}
 680 objectClass: top
 681 objectClass: controlAccessRight
 682 displayName: Phone and Mail Options
 683 rightsGuid: E45795B2-9455-11d1-AEBD-0000F80367C1
 684 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 685 appliesTo: bf967a9c-0de6-11d0-a285-00aa003049e2
 686 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 687 validAccesses: 48
 688
 689 dn: CN=Web-Information,CN=Extended-Rights,${CONFIGDN}
 690 objectClass: top
 691 objectClass: controlAccessRight
 692 displayName: Web Information
 693 rightsGuid: E45795B3-9455-11d1-AEBD-0000F80367C1
 694 appliesTo: 4828CC14-1437-45bc-9B07-AD6F015E5F28
 695 appliesTo: 5cb41ed0-0e4c-11d0-a286-00aa003049e2
 696 appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
 697 validAccesses: 48
 698
 699 dn: CN=DS-Replication-Get-Changes,CN=Extended-Rights,${CONFIGDN}
 700 objectClass: top
 701 objectClass: controlAccessRight
 702 displayName: DS Replication Get Changes
 703 rightsGuid: 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2
 704 appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
 705 appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
 706 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 707 validAccesses: 256
 708
 709 dn: CN=DS-Replication-Synchronize,CN=Extended-Rights,${CONFIGDN}
 710 objectClass: top
 711 objectClass: controlAccessRight
 712 displayName: DS Replication Synchronize
 713 rightsGuid: 1131f6ab-9c07-11d1-f79f-00c04fc2dcd2
 714 appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
 715 appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
 716 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 717 validAccesses: 256
 718
 719 dn: CN=DS-Replication-Manage-Topology,CN=Extended-Rights,${CONFIGDN}
 720 objectClass: top
 721 objectClass: controlAccessRight
 722 displayName: DS Replication Manage Topology
 723 rightsGuid: 1131f6ac-9c07-11d1-f79f-00c04fc2dcd2
 724 appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
 725 appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
 726 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 727 validAccesses: 256
 728
 729 dn: CN=Change-Schema-Master,CN=Extended-Rights,${CONFIGDN}
 730 objectClass: top
 731 objectClass: controlAccessRight
 732 displayName: Change Schema Master
 733 rightsGuid: e12b56b6-0a95-11d1-adbb-00c04fd8d5cd
 734 appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
 735 validAccesses: 256
 736
 737 dn: CN=DS-Replication-Get-Changes-In-Filtered-Set,CN=Extended-Rights,${CONFIGDN}
 738 objectClass: top
 739 objectClass: controlAccessRight
 740 displayName: DS Replication Get Changes In Filtered Set
 741 rightsGuid: 89e95b76-444d-4c62-991a-0facbeda640c
 742 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 743 appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
 744 appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
 745 validAccesses: 256
 746
 747 dn: CN=Run-Protect-Admin-Groups-Task,CN=Extended-Rights,${CONFIGDN}
 748 objectClass: top
 749 objectClass: controlAccessRight
 750 displayName: Run Protect Admin Groups Task
 751 rightsGuid: 7726b9d5-a4b4-4288-a6b2-dce952e80a7f
 752 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 753 validAccesses: 256
 754
 755 dn: CN=Manage-Optional-Features,CN=Extended-Rights,${CONFIGDN}
 756 objectClass: top
 757 objectClass: controlAccessRight
 758 displayName: Manage Optional Features
 759 rightsGuid: 7c0e2a7c-a419-48e4-a995-10180aad54dd
 760 appliesTo: ef9e60e0-56f7-11d1-a9c6-0000f80367c1
 761 validAccesses: 256
 762
 763 dn: CN=Read-Only-Replication-Secret-Synchronization,CN=Extended-Rights,${CONFIGDN}
 764 objectClass: top
 765 objectClass: controlAccessRight
 766 displayName: Read Only Replication Secret Synchronization
 767 rightsGuid: 1131f6ae-9c07-11d1-f79f-00c04fc2dcd2
 768 appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
 769 appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
 770 appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 771 validAccesses: 256
 772 ${INC2012}
 773 ${INC2012}dn: CN=Validated-MS-DS-Behavior-Version,CN=Extended-Rights,${CONFIGDN}
 774 ${INC2012}objectClass: controlAccessRight
 775 ${INC2012}rightsGuid: d31a8757-2447-4545-8081-3bb610cacbf2
 776 ${INC2012}appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
 777 ${INC2012}displayName: Validated write to MS DS behavior version
 778 ${INC2012}localizationDisplayId: 81
 779 ${INC2012}validAccesses: 8
 780 ${INC2012}showInAdvancedViewOnly: TRUE
 781 ${INC2012}
 782 ${INC2012}dn: CN=Validated-MS-DS-Additional-DNS-Host-Name,CN=Extended-Rights,${CONFIGDN}
 783 ${INC2012}objectClass: controlAccessRight
 784 ${INC2012}rightsGuid: 80863791-dbe9-4eb8-837e-7f0ab55d9ac7
 785 ${INC2012}appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
 786 ${INC2012}displayName: Validated write to MS DS Additional DNS Host Name
 787 ${INC2012}localizationDisplayId: 82
 788 ${INC2012}validAccesses: 8
 789 ${INC2012}showInAdvancedViewOnly: TRUE
 790 ${INC2012}
 791 ${INC2012}dn: CN=DS-Clone-Domain-Controller,CN=Extended-Rights,${CONFIGDN}
 792 ${INC2012}objectClass: controlAccessRight
 793 ${INC2012}displayName: Allow a DC to create a clone of itself
 794 ${INC2012}rightsGuid: 3e0f7e18-2c7a-4c10-ba82-4d926db99a3e
 795 ${INC2012}appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 796 ${INC2012}validAccesses: 256
 797 ${INC2012}localizationDisplayId: 80
 798 ${INC2012}
 799 ${INC2012}dn: CN=Certificate-AutoEnrollment,CN=Extended-Rights,${CONFIGDN}
 800 ${INC2012}objectClass: controlAccessRight
 801 ${INC2012}showInAdvancedViewOnly: TRUE
 802 ${INC2012}appliesTo: e5209ca2-3bba-11d2-90cc-00c04fd91ab1
 803 ${INC2012}displayname: AutoEnrollment
 804 ${INC2012}localizationDisplayId: 83
 805 ${INC2012}rightsGuid: a05b8cc2-17bc-4802-a710-e7c15ab866a2
 806 ${INC2012}validAccesses: 256
 807 ${INC2012}
 808 ${INC2012}dn: CN=DS-Set-Owner,CN=Extended-Rights,${CONFIGDN}
 809 ${INC2012}objectClass: controlAccessRight
 810 ${INC2012}displayName: Set Owner of an object during creation.
 811 ${INC2012}rightsGuid: 4125c71f-7fac-4ff0-bcb7-f09a41325286
 812 ${INC2012}appliesTo: 26f11b08-a29d-4869-99bb-ef0b99fd883e
 813 ${INC2012}validAccesses: 256
 814 ${INC2012}
 815 ${INC2012}dn: CN=DS-Bypass-Quota,CN=Extended-Rights,${CONFIGDN}
 816 ${INC2012}objectClass: controlAccessRight
 817 ${INC2012}displayName: Bypass the quota restrictions during creation.
 818 ${INC2012}rightsGuid: 88a9933e-e5c8-4f2a-9dd7-2527416b8092
 819 ${INC2012}appliesTo: 26f11b08-a29d-4869-99bb-ef0b99fd883e
 820 ${INC2012}validAccesses: 256
 821 ${INC2012}
 822 ${INC2012}dn: CN=DS-Read-Partition-Secrets,CN=Extended-Rights,${CONFIGDN}
 823 ${INC2012}objectClass: controlAccessRight
 824 ${INC2012}displayName: Read secret attributes of objects in a Partition
 825 ${INC2012}rightsGuid: 084c93a2-620d-4879-a836-f0ae47de0e89
 826 ${INC2012}appliesTo: 26f11b08-a29d-4869-99bb-ef0b99fd883e
 827 ${INC2012}validAccesses: 256
 828 ${INC2012}
 829 ${INC2012}dn: CN=DS-Write-Partition-Secrets,CN=Extended-Rights,${CONFIGDN}
 830 ${INC2012}objectClass: controlAccessRight
 831 ${INC2012}displayName: Write secret attributes of objects in a Partition
 832 ${INC2012}rightsGuid: 94825A8D-B171-4116-8146-1E34D8F54401
 833 ${INC2012}appliesTo: 26f11b08-a29d-4869-99bb-ef0b99fd883e
 834 ${INC2012}validAccesses: 256
 835