Windows Server 2003 Security: A Technical Reference

Additional Security Configuration

In addition to the security configuration that can be done in GPOs and security templates, other items should be addressed:

• Group membership— Membership in groups that have administrative privileges should be carefully considered and monitored. Examples of groups to pay particular attention to are Enterprise Admins and Schema Admins. Enterprise Admins can administer every domain in the forest and have additional forest-wide administration privileges not given to Domain Admins. Membership in Enterprise Admins should be restricted. Schema Admins can modify the Active Directory schema, a privilege that should not be given out lightly; in fact, best practices recommend that this group be empty until the need to ...