Re: Delegate Control?
- From: "Joe Richards [MVP]" <humorexpress@xxxxxxxxxxx>
- Date: Tue, 04 Jul 2006 12:00:05 -0400
Use dsacls and dump the ACLs of various objects in your domain, it is all documented there what can be read by who. By default, AD is very open in who can read what to make it so the maximum number of apps can run with minimal issues. If you want a very locked down LDAP directory, take a peek at ADAM which is locked down by default and you have to open it up. AD would have been like that too had it come out after the security lockdown occurred. Unfortunately it didn't and to do a wholesale change now can really dork up applications.
joe
--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net
---O'Reilly Active Directory Third Edition now available---
http://www.joeware.net/win/ad3e.htm
Dan wrote:
Hi,.
Do "normal" users have access to query AD OU's? I created a user today named 'svc-service' and gave it read access only to a single OU via the delegation of control wizard. To my surprise it turns out that the account is also able to query all of the other OU's in my domain (not just nested OU's but even one's at the same level as where I gave it access). Am I missing something here? Why would an account that has no other rights be able to query these other OU's? For example, at the top of my domain structure (dc=company,dc=com) sits an OU named 'America' (ou=america,dc=company,dc=com) and another one named 'Africa' (ou=africa,dc=company,dc=com). Why if I did a delegate of control and gave read access to a low level account (domain user only) to the Africa OU would it also be able to read from America? Is that just built in through Authenticated Users or something?
Thanks,
D
- Prev by Date: Re: active directory group locked
- Next by Date: Re: External trusts between domains are there any risks?
- Previous by thread: Re: active directory group locked
- Next by thread: Re: Define routes between DC in multi NIC scenario
- Index(es):
Relevant Pages
|
