<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Nadiya:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I tried the steps in the kb article and that did enable me to display the objects in the “Deleted Objects” containers for a non-admin user.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I’ll file a bug against MS-ADTS to include the “LIST CONTENTS” and “READ PROPERTY” permissions on CN=Deleted Objects container to undelete a deleted object.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I am working to see how can I provide you with instructions to see the security descriptor of the deleted objects container.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Obaid Farooqi<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Escalation Engineer | Microsoft<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Exceeding your expectations is my highest priority. If you would like to provide feedback on your case you may contact my manager at nkang at Microsoft dot com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> nivanova.samba@gmail.com [mailto:nivanova.samba@gmail.com]
<b>On Behalf Of </b>Nadezhda Ivanova<br>
<b>Sent:</b> Wednesday, November 19, 2014 10:44 AM<br>
<b>To:</b> Obaid Farooqi<br>
<b>Cc:</b> Nadezhda Ivanova; MSSolve Case Email; cifs-protocol@samba.org<br>
<b>Subject:</b> Re: [REG:114102711953179] Re: Undelete operation security considerations [MS-ADTS] 3.1.1.5.3.7.1 [REG: 114102711953179]<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi Obaid,<br>
I was not able to give a LC permission to a general user via LDAP, because it appears that even Administrator does not have permissions to see or modify the security descriptor on Deleted Objects.<br>
The only way to do it it seems is described here:<br>
<a href="http://support.microsoft.com/kb/892806">http://support.microsoft.com/kb/892806</a><br>
and I haven't tried it.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">This is the reason I am asking - apart from clarifying the required permissions - if you can provide me with an example of what the SD on Deleted Objects would look like on a fresh installation, preferably in
sddl format, or advise me on the best way to "see" it - the ADAM tool does not seem to provide such functionality. The way it list the permissions is not specific enough for me to ensure that samba has similar behavior.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Thank you for all your help on this matter!<o:p></o:p></p>
</div>
<p class="MsoNormal">Best Regards,<o:p></o:p></p>
</div>
<p class="MsoNormal">Nadya<o:p></o:p></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><br>
On Wed, Nov 19, 2014 at 6:10 PM, Obaid Farooqi <<a href="mailto:obaidf@microsoft.com">obaidf@microsoft.com</a>> wrote:<br>
> Hi Nadiya:<br>
> Still working on it. I am able successfully repro this issue and getting closer to a resolution.<br>
> BTW, were you able to list the deleted objects for a general user after you gave him list children permission on deleted object container?<br>
><br>
> Regards,<br>
> Obaid Farooqi<br>
> Escalation Engineer | Microsoft<br>
><br>
> Exceeding your expectations is my highest priority. If you would like to provide feedback on your case you may contact my manager at nkang at Microsoft dot com<br>
><br>
> -----Original Message-----<br>
> From: "Nadezhda Ivanova" <<a href="mailto:nivanova@samba.org">nivanova@samba.org</a>><br>
> Sent: Monday, November 10, 2014 2:44 PM<br>
> To: "Obaid Farooqi" <<a href="mailto:obaidf@microsoft.com">obaidf@microsoft.com</a>><br>
> Cc: "Nadezhda Ivanova" <<a href="mailto:nivanova@samba.org">nivanova@samba.org</a>>; "<a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a>" <<a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a>>; "MSSolve Case Email" <<a href="mailto:casemail@microsoft.com">casemail@microsoft.com</a>><br>
> Subject: [REG:114102711953179] Re: Undelete operation security considerations [MS-ADTS] 3.1.1.5.3.7.1 [REG: 114102711953179]<br>
><br>
> Hi Obaid,<br>
> I used the control, and it did not help. After all, without it even Admin would not be able to do the undelete :).<br>
> I attempted the exact same thing you describe, but even in ldp the general user was not able to list the contents of Deleted objects, control or not. It worked if I bind as Administrator, and that's why I assume it is an issue with the List Children permissions
granted on Deleted Objects container.<br>
><br>
> Regards,<br>
> Nadya<br>
><br>
> On Mon, Nov 10, 2014 at 9:46 PM, Obaid Farooqi <<a href="mailto:obaidf@microsoft.com">obaidf@microsoft.com</a>><br>
> wrote:<br>
>> Hi Nadiya:<br>
>> I was wondering if the ldap control " Show Deleted Object" resolved<br>
> your issue.<br>
>><br>
>> Regards,<br>
>> Obaid Farooqi<br>
>> Escalation Engineer | Microsoft<br>
>><br>
>> Exceeding your expectations is my highest priority. If you would<br>
> like to provide feedback on your case you may contact my manager at nkang at Microsoft dot com<br>
><br>
>><br>
>> -----Original Message-----<br>
>> From: "Obaid Farooqi" <<a href="mailto:obaidf@microsoft.com">obaidf@microsoft.com</a>><br>
>> Sent: Thursday, November 6, 2014 6:03 PM<br>
>> To: "Nadezhda Ivanova" <<a href="mailto:nivanova@samba.org">nivanova@samba.org</a>><br>
>> Cc: "<a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a>" <<a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a>>; "MSSolve<br>
> Case Email" <<a href="mailto:casemail@microsoft.com">casemail@microsoft.com</a>><br>
>> Subject: [REG:114102711953179] Undelete operation security<br>
> considerations [MS-ADTS] 3.1.1.5.3.7.1 [REG: 114102711953179]<br>
><br>
>><br>
>> Hi Nadiya:<br>
>> Have you made deleted objects visible? By default, the CN=Deleted<br>
> Objects container is not displayed. You need to make the CN=Deleted Objects container visible. Here is how to do that:<br>
><br>
>><br>
>> To display Deleted Objects container<br>
>> 1.Open Ldp.exe and click Options menu, then click Controls.<br>
>> 2.In Controls dialog, expand Load Predefined pull-down menu, select<br>
> Return deleted objects, and then click OK.<br>
>> 3.To verify that the Deleted Objects container is displayed:<br>
>> a.Connect and bind to the server hosting the forest root domain of<br>
> your AD DS environment.<br>
>> b.Click View, click Tree, and in BaseDN field, type<br>
> DC=mydomain,DC=com (where mydomain and com is the appropriate forest root domain name of your AD DS environment).<br>
><br>
>><br>
>> c.In the console tree, double-click the root DN and locate CN=Deleted<br>
> Objects, DC=mydomain,DC=com container (where mydomain and com is the appropriate forest root domain name of your AD DS environment).<br>
><br>
>><br>
>> This is an ldp.exe specific instructions but in a nutshell, By using<br>
> the Show Deleted Object control (controlType = 1.2.840.113556.1.4.417), in conjunction with search commands, you can view Active Directory objects that have been deleted.<br>
><br>
>><br>
>> Please let me know if it answers your question.<br>
>><br>
>><br>
>><br>
>> Regards,<br>
>> Obaid Farooqi<br>
>> Escalation Engineer | Microsoft<br>
>><br>
>> Exceeding your expectations is my highest priority. If you would<br>
> like to provide feedback on your case you may contact my manager at nkang at Microsoft dot com<br>
><br>
>><br>
>> -----Original Message-----<br>
>> From: <a href="mailto:nivanova.samba@gmail.com">nivanova.samba@gmail.com</a> [mailto:<a href="mailto:nivanova.samba@gmail.com">nivanova.samba@gmail.com</a>] On<br>
> Behalf Of Nadezhda Ivanova<br>
>> Sent: Thursday, November 6, 2014 4:27 PM<br>
>> To: Obaid Farooqi<br>
>> Cc: Nadezhda Ivanova; <a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a>; MSSolve Case Email<br>
>> Subject: Re: [REG:114102711953179] Undelete operation security<br>
> considerations [MS-ADTS] 3.1.1.5.3.7.1 [REG: 114102711953179]<br>
><br>
>><br>
>> Hi Obaid,<br>
>> I am using win2008R2. The user is not able to perform the undelete,<br>
> because he does not seem to have permission to list the contents of Deleted Objects, and to him, the object is non-existent. And it also appears that not even Administrator can grant LC permissions to a user on the Deleted Objects container, so that effectively
makes it impossible for any user other than a member of Administrators to perform an undelete... Negative testing works, though - adding ACE's that deny the permissions specified in the docs prevent even a member of Administrators group from performing the
op.<br>
><br>
>><br>
>> Regards,<br>
>> Nadya<br>
>><br>
>> On Thu, Nov 6, 2014 at 7:54 PM, Obaid Farooqi <<a href="mailto:obaidf@microsoft.com">obaidf@microsoft.com</a>><br>
>> wrote:<br>
>>> Hi Nadiya:<br>
>>> Can you please send me an lsass ttt trace of the failure scenario<br>
>> i.e. when your user has the permissions required by MS-ADTS but still<br>
> not able to undelete? Please let me know the version of DC where you are trying to undelete the tombstone object so that I can send you appropriate binaries.<br>
><br>
>><br>
>>><br>
>>> Regards,<br>
>>> Obaid Farooqi<br>
>>> Escalation Engineer | Microsoft<br>
>>><br>
>>> Exceeding your expectations is my highest priority. If you would<br>
>> like<br>
>>> to provide feedback on your case you may contact my manager at nkang<br>
>>> at Microsoft dot com<br>
>>><br>
>>> -----Original Message-----<br>
>>> From: "Obaid Farooqi" <<a href="mailto:obaidf@microsoft.com">obaidf@microsoft.com</a>><br>
>>> Sent: Monday, November 3, 2014 12:24 PM<br>
>>> To: "Nadezhda Ivanova" <<a href="mailto:nivanova@samba.org">nivanova@samba.org</a>><br>
>>> Cc: "<a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a>" <<a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a>>; "MSSolve<br>
>> Case<br>
>>> Email" <<a href="mailto:casemail@microsoft.com">casemail@microsoft.com</a>><br>
>>> Subject: [REG:114102711953179] Undelete operation security<br>
>>> considerations [MS-ADTS] 3.1.1.5.3.7.1 [REG: 114102711953179]<br>
>>><br>
>>> Hi Nadiya:<br>
>>> I am still working on this issue and will be in touch as soon as I<br>
>> have an answer.<br>
>>><br>
>>> Regards,<br>
>>> Obaid Farooqi<br>
>>> Escalation Engineer | Microsoft<br>
>>><br>
>>> Exceeding your expectations is my highest priority. If you would<br>
>> like<br>
>>> to provide feedback on your case you may contact my manager at nkang<br>
>>> at Microsoft dot com<br>
>>><br>
>>> -----Original Message-----<br>
>>> From: Obaid Farooqi<br>
>>> Sent: Tuesday, October 28, 2014 10:14 AM<br>
>>> To: 'Nadezhda Ivanova'<br>
>>> Cc: '<a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a>'; MSSolve Case Email<br>
>>> Subject: RE: [REG:114102711953179] Undelete operation security<br>
>>> considerations [MS-ADTS] 3.1.1.5.3.7.1 [REG: 114102711953179]<br>
>>><br>
>>> Hi Nadiya:<br>
>>> I'll help you with this issue and will be in touch as soon as I have<br>
>> an answer.<br>
>>><br>
>>> Regards,<br>
>>> Obaid Farooqi<br>
>>> Escalation Engineer | Microsoft<br>
>>><br>
>>> Exceeding your expectations is my highest priority. If you would<br>
>> like<br>
>>> to provide feedback on your case you may contact my manager at nkang<br>
>>> at Microsoft dot com<br>
>>><br>
>>> -----Original Message-----<br>
>>> From: "Obaid Farooqi" <<a href="mailto:obaidf@microsoft.com">obaidf@microsoft.com</a>><br>
>>> Sent: Monday, October 27, 2014 10:03 AM<br>
>>> To: "Nadezhda Ivanova" <<a href="mailto:nivanova@samba.org">nivanova@samba.org</a>><br>
>>> Cc: "<a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a>" <<a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a>>; "MSSolve<br>
>> Case<br>
>>> Email" <<a href="mailto:casemail@microsoft.com">casemail@microsoft.com</a>><br>
>>> Subject: [REG:114102711953179] Undelete operation security<br>
>>> considerations [MS-ADTS] 3.1.1.5.3.7.1 [REG: 114102711953179]<br>
>>><br>
>>> Hi Nadiya:<br>
>>> Thanks for contacting Microsoft. I have created a case to track this<br>
>> issue. A member of the open specifications team will be in touch soon.<br>
>><br>
>>><br>
>>> Regards,<br>
>>> Obaid Farooqi<br>
>>> Escalation Engineer | Microsoft<br>
>>><br>
>>> Exceeding your expectations is my highest priority. If you would<br>
>> like<br>
>>> to provide feedback on your case you may contact my manager at nkang<br>
>>> at Microsoft dot com<br>
>>><br>
>>> -----Original Message-----<br>
>>> From: <a href="mailto:nivanova.samba@gmail.com">nivanova.samba@gmail.com</a> [mailto:<a href="mailto:nivanova.samba@gmail.com">nivanova.samba@gmail.com</a>] On<br>
>>> Behalf Of Nadezhda Ivanova<br>
>>> Sent: Monday, October 27, 2014 9:19 AM<br>
>>> To: Interoperability Documentation Help<br>
>>> Cc: <a href="mailto:cifs-protocol@samba.org">cifs-protocol@samba.org</a><br>
>>> Subject: Undelete operation security considerations [MS-ADTS]<br>
>>> 3.1.1.5.3.7.1<br>
>>><br>
>>> Dear Dochelp,<br>
>>> I am currently trying to implement the proper access checking when<br>
>> executing an undelete operation, and I have established that the<br>
> access rights described in 3.1.1.5.3.7.1, when granted to a regular Domain User, are not enough to enable that user to perform an Undelete operation.<br>
><br>
>><br>
>>><br>
>>> Some investigation showed that the user also needs List Children<br>
>> permission on the Deleted Objects container, but I can't find this<br>
> mentioned in ADTS, am I looking in the wrong place?<br>
><br>
>><br>
>>><br>
>>> Also, could you please direct me to where the default security<br>
>>> descriptor of a Deleted Objects container (say, after a fresh<br>
>>><br>
>>> installation) is documented? It seems that it is a special case -<br>
>> according to <a href="http://support.microsoft.com/kb/892806">http://support.microsoft.com/kb/892806</a>, inheritance is<br>
> broken, and even Domain Admins are only allowed a very limited set of rights. I would appreciate some more specific information that the output of the tool,an example SD in SDDL format would be best.<br>
><br>
>><br>
>>><br>
>>> Best Regards,<br>
>>> Nadezhda Ivanova<br>
>>><br>
>>><br>
>><br>
><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>