3 ms·
I know. It really is quite scary, if you have been in a for-real security audit actually. We wouldn't be creating admin workstations if the security story with
by kaliszad 6y ago
I know. It really is quite scary, if you have been in a for-real security audit actually. We wouldn't be creating admin workstations if the security story with AD would be so great, hint - it isn't. Exchange must communicate with AD with much higher permissions than most users. It really is scary how many barriers will be crossed just so anything you would expect, like contacts, works.
- Godel_unicode 6y agoI've been a part of many for-real security audits. This is largely incorrect scare-mongering. Separate admin workstations are symptomatic of a bad security posture and check-box security, they are absolutely not necessitated by nebulous concerns about the directory being readable. Of course a server process which is designed to modify (among other things) group memberships needs different permissions than a user, why would that not be the case...? If you don't like it being highly privileged, don't grant it the permissions. Or hire someone who can.