We filter out WriteAccountRestrictions if it originates from Domain Admins. DA does have this permission by default on all computer objects, so I assume we did this to avoid creating another edge from Domain Admins to all computer nodes.
It is the only edge where we do that, why it could lead to confusion.
This commit removes this filter.
Motivation and Context
How Has This Been Tested?
Screenshots (if appropriate):
Types of changes
[ ] Chore (a change that does not modify the application functionality)
[ ] Bug fix (non-breaking change which fixes an issue)
[x] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to change)
Checklist:
[ ] Documentation updates are needed, and have been made accordingly.
[ ] I have added and/or updated tests to cover my changes.
Description
We filter out WriteAccountRestrictions if it originates from Domain Admins. DA does have this permission by default on all computer objects, so I assume we did this to avoid creating another edge from Domain Admins to all computer nodes.
It is the only edge where we do that, why it could lead to confusion.
This commit removes this filter.
Motivation and Context
How Has This Been Tested?
Screenshots (if appropriate):
Types of changes
Checklist: