Re: restrict users from changing group membership
no one should be able to modify group membership by default...someone has
granted inappropriate permissions somewhere for them to be able to do
this...
--
Susan Conkey [MVP]
"tchast" <tchast@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:AC104382-5F6E-4F55-95CB-BD75C5C4CA93@xxxxxxxxxxxxxxxx
When a user opens the global address book in Outlook, they can modify
group
membership. How do I restrict them from being able to modify these
groups?
What minimum permissions do they need to be just able to read the members
of
those groups?
Authenticated Users and Everyone only have: Read; Execute; read
Permissions;
List Contents; Read Properties; and List Object.
These were all setup by default, in other word, they came with the
creation
of the group
.
Relevant Pages
- Re: Group Policy and Local Admin rights
... If you used Restricted Groups ... feature of the GP to restrict membership in the Administrators group, ... They need to write files somewhere where normal users dont have Modify ... > have LOCAL admin rights for a very "picky" application. ...
(microsoft.public.windows.server.active_directory) - Re: Group manager
... You only modify distribution groups from Outlook. ... This posting is provided "AS IS" with no warranties, and confers no rights. ... and select the "Manager can update membership list" ...
(microsoft.public.windows.server.active_directory) - Re: Restricting Domain Admins
... Just after posting I noticed that what you were attempting to modify does ... not prevent then from changing the membership of those groups, ... > Removed Modify permission ... > Removed modify owner permission ...
(microsoft.public.windows.server.security) - Re: Managed by parameter not working on a Universal Group between 2 do
... Joe Richards Microsoft MVP Windows Server Directory Services ... group membership can be retrieved from that GC since uni groups publish membership to the global catalogs but can't be updated there. ... The protocol being used is NSPI and it doesn't support referrals so you get the error that you don't have permissions to modify the membership which is correct, no one has permissions to modify a Domain A group on a Domain B Domain Controller. ...
(microsoft.public.exchange2000.active.directory.integration) - Re: restrict users from changing group membership
... granted inappropriate permissions somewhere for them to be able to do ... The Pre-Windows 2000 Compatibility group allows "read" access to group ... alter the membership of the groups. ...
(microsoft.public.exchange.admin) |
|
