Special Edition Using Microsoft Active Directory

Authorizing Access to Active Directory

Every object in the Active Directory has a list of who can and cannot touch the object. This list and the services that use the list comprise the authorization component of the Windows 2000 security architecture. Every attempt to access a resource must pass through this component to receive permission to use the resource. This chapter discusses the architecture of authorization and then looks at some examples of using that architecture to both grant and deny access to Active Directory objects.