jperezduerto.info
Security in depth · Unit 24 · Lesson 7 of 14
A directory describes; services enforce
Separate a recorded directory change from the decision a consuming application actually makes.
Helpful before thisActive Directory
After this lesson you can
- Explain why matching directory replicas do not prove that an application refreshed its authorization data.
The directory can be current while a consuming application is still looking at yesterday's list.
Follow the information to its consumer
Active Directory Domain Services stores identities, group relationships, and configuration. Domain controllers replicate directory data, while applications and operating systems use it within their own authentication and authorization designs.
Replica consistency and application enforcement are different claims. A consumer may use a session, token, or cached membership rather than reading the directory for every decision. Its documented behavior determines when a change affects access; there is no universal refresh time for every application.
Supplied record: the community publisher
The fictional publisher approves Mira’s removal from its editors group at 09:00.
Directory replicas D1 and D2, 09:02: Mira absent from Editors.
Application snapshot: captured at 08:55; Mira present.
Documented application rule: editing uses that snapshot until a successful refresh.
Next scheduled refresh: 09:25; completion not yet recorded.
Assume these records cover the same identity and group, and no other grant is involved. The directory evidence supports the removal on D1 and D2. The application’s older snapshot still supports editing under its stated rule. This does not contradict the directory records.
Write a bounded completion note
Record the directory change as observed, but keep application enforcement open. Assign the application owner to confirm a successful refresh and the expected denial of Mira’s editing while preserving approved editors.
An appointment on a schedule is not evidence that processing succeeded. Your note should distinguish the planned time from the observed result and identify the affected consumer. Another application may use different refresh or session rules, so it needs its own closure evidence.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Both directory replicas show Mira removed, but the application still uses its earlier membership snapshot. What is established?
Show the answer
Correct answer: The directory change is visible on those replicas; the application has not yet demonstrated the new access decision. Replica agreement concerns stored directory data. The supplied application snapshot is older and still controls its own authorization decision.
Try it
- WriteWrite a three-row status note for the directory replicas, the application snapshot, and the access decision. Name confirmed evidence, the remaining gap, and the owner who should confirm closure.