Re: restrict read access

From: Joe Richards [MVP] (humorexpress_at_hotmail.com)
Date: 07/13/04 

Date: Tue, 13 Jul 2004 09:41:44 -0400

This isn't going to be the most fun.

One method would be to place all users you don't want the program to enumerate
in an OU branch and then on that branch add a DENY Read Property to the userID.

The dsacls command would look like this

dsacls OU=somesubou,OU=someou,DC=domain,DC=com /I:S /D domain\user:RP

It would probably be better though to assign the permission to a group and add
the user to the group in case there were other programs you wanted to do this
with so instead do this

dsacls OU=somesubou,OU=someou,DC=domain,DC=com /I:S /D domain\group:RP

Once this is done, unless there is an EXPLICIT ACE on the user object for the ID
to add permissions back, you will get an access denied when trying to enumerate
the specific user ids in that OU and a complete domain enumeration would miss
them entirely.

   joe 

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net
ano wrote:
> Hi folks,
> 
> we have an ad-domain with an nt4-domain. in this domain is 
> an (very) old app that reads all accounts (with an service-
> account) and stores in an interna database.
> 
> we would like to restrict that to an special OU. But how???
> 
> we set the permissions for the service-account to "full 
> control = deny", but it did'nt work. we have still all 
> domain-accounts in the db. the service-account still reads 
> all ad-objects.
> 
> any idea how to restict that?
> 
> thanks...

Relevant Pages

  • Re: Auditing a Domain from a Guest Account
    ... In NT4 Guests can enumerate users & groups and shares, ... NTFS permissions usually not; you can only enumerate what you can ... Am I nuts for even entertaining the notion that a guest account ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: Security User access question
    ... >> I am not even sure if Active Directory can provide this ... >it could be done with vbscript. ... >permissions, what permissions they have and, in the case ... >enumerate the group membership to find out the users. ...
    (microsoft.public.security)
  • Re: Security User access question
    ... > I am not even sure if Active Directory can provide this ... permissions, what permissions they have and, in the case of a group, ... enumerate the group membership to find out the users. ... The other option would be to combine vbscript with perms.exe (from the ...
    (microsoft.public.security)
  • Re: Monitor system
    ... sure your ASP.NET worker thread has permissions to enumerate the processes ... Eric Lawrence ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: How To Display File Permssions Recursively on File Server
    ... server with approximately 300 user home directories which would show ... the 'Everyone' group had permissions and what those permissions are? ... Use Xcacls To Enumerate Ntfs PermissionsEXE to enumerate NTFS folder ...
    (microsoft.public.windows.server.general)