Re: Limit access to Active Directory Users and Computers

Does anyone know how to limit the users access who have downloaded the Admin
Pack. We would like only to allow certian users and other users not to have
access.

"APD189" wrote:

They downloaded the Admin Pack onto their own computer and installed the
admin pack on their local machine. I need to block what they see in it.

Thanks!!

"Florian Frommherz [MVP]" wrote:

Howdie!

APD189 wrote:
What I need to do is restrict users from using the Admin Pack and using
Active Directory Users and Computers. When I disabled a single user, he was
not able to remote to a server he had access to in the past. I think when I
denied "read" permissions, he was not able to log in because when I removed
his name, he was able to log back in.

How do they access those tools? Are they installed locally on the users'
machines or do they use an rdp (termanial services) connection to the DC
and make their changes there? From your description it sounds like that.

Disabling the user in ADUC is not a way to go as that "disable"
mechanism blocks his user account he needs to authenticate to the whole
network. How do they access the AdminPak? Can't you just tweak NTFS
permissions on the .msc files?

cheers,

Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste

.

Relevant Pages

  • RE: Controlling Admin Access
    ... AFAIK disabling auditing, as well as deleting any audit entry, generates ... Subject: Controlling Admin Access ...
    (Focus-Microsoft)
  • Re: After installing WIn XP SP2, only able to boot in safe mode, a
    ... then try going in and Disabling everything ... then try uninstalling SP2 while logged in as Admin. ... I have tried but cannot get System Restore to work. ... didn't uncheck all services and turn off my Zonealarm ...
    (microsoft.public.windowsupdate)
  • Re: File sharing, major security issue
    ... >>name that starts with a special character. ... The permissions for the file sharing ... Check the Windows Admin groups or a Google ... disabling the automatic admin share is a simple registry ...
    (microsoft.public.inetserver.iis.security)
  • Re: URGENT - Cant Log On to SBS2003 box
    ... We have tried to log on locally with the admin account and a few ... The message means the user is not allowed to logon interactively, ... somehow can't think of any way disabling the NIC could reasult in such an ... server machine) and Remote Desktop? ...
    (microsoft.public.windows.server.sbs)
  • Forgotten Admin Password
    ... Does anyone know if there is a way to reset the admin ... password in Windows 2000 Professional, ... Pack 4? ... I cannot remember my admin password, ...
    (microsoft.public.win2000.security)
Loading