AD permissions updates CVE-2021-42291 and AO Clusters/GL

  • I have an SQLSERVER Always on Environment.

    In AD it's logging:  The directory service detected an LDAP modify request for the folling object that normally would have been blocked for the following security reasons.  The client included an nTSecurityDescriptor attribute in the add request but did not have explicit permissions to write one or more parts of the new security descriptor, based on the default merge security descriptor.

     

    The request was allowed to proceed because the directory is currently configured in audit-only mode for this security check.

     

    ObjectDN:  ComputerGL

    Object class:  computer

    user ftsad\clustername$

    Client IP:  clusterIP

     

    Microsoft will be turning this security check on.  I know I can explicitly grant additional access but is there a better way in achieving this?

  • Thanks for posting your issue and hopefully someone will answer soon.

    This is an automated bump to increase visibility of your question.

  • Hello Shelley Allen,

    Did you get any update on this? we experience the same.

  • I didn’t

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply