3.1.1.6.1.1 Authoritative Security Descriptor

The security descriptor that is written to protected objects is stored in the nTSecurityDescriptor attribute on the AdminSDHolder object in Active Directory. The AdminSDHolder object is of class container and has a DN of "CN=AdminSDHolder,CN=System,<Domain NC DN>".