?
Solved

Restrict Clients from viewing Domain Structue/OUs using GPMC

Posted on 2007-04-05
11
Medium Priority
?
693 Views
Last Modified: 2012-05-05
Server 2003 SP1 and AD 2003
Clients (workstations) - XP PRO.  Domain users are local administrators on the client machine.

GPMC can be used on any client to view policies that apply to each OU.  I want to restrict it such that no client machine can view GP policies per OU.  For example, I have an OU for Sales.  I don't want a user in the Finance department to be able to run GPMC on their machine and be able to browse the OUs in the domain and see what login scripts, policies, etc they are using.  

For that matter, I don't want any client able to view the Domain/OU structure!

Thanks,

0
Comment
Question by:top_rung
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
11 Comments
 
LVL 26

Expert Comment

by:MidnightOne
ID: 18861743
Unless they have domain admin rights on the domain, they shouldn't have the access rights to use the GPMC or ADUC tools against a domain controller.
0
 
LVL 14

Author Comment

by:top_rung
ID: 18863839
yeah, that is what i expected, but they can use the GPMC.  The users are only Authenticated Domains users.  No administrative rights whatsoever except on their local machines.    

They can not make any changes, but they can view the structure and such.  :-\
0
 
LVL 26

Expert Comment

by:MidnightOne
ID: 18864457
Do the clients -require- admin access on t he local machines? Although that's a separate problem, it will keep them from installing the admin tools and other idiocy.
0
Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

 
LVL 14

Author Comment

by:top_rung
ID: 18864762
Yes they require it - being developers and such.  That company policy won't change unfortunately.

I just can't believe that it is that simple to browse the hierarchy on the domain controller.  This is a problem because employees using the tool are seeing the tiers of management and the varying share rights based on OU names and script names.  

I need to restrict it if at all possible.

0
 
LVL 14

Author Comment

by:top_rung
ID: 18867180
up'd points
0
 
LVL 26

Expert Comment

by:MidnightOne
ID: 18868411
Unfortunately, you won't ben able to stop them from getting at the logon scripts at all; these are housed at %logonserver%\netlogon and all users have RX privileges to that share and files.

It's possible to use GPO software installation to remove the admin tools from the user's workstations, but given the myriad versions this may be cumbersome at best.

Do the users have the tools installed locally?
0
 
LVL 14

Author Comment

by:top_rung
ID: 18892416
Yes, the users have the tools installed locally.

Again, it isn't simply the viewing of the scripts, but more so the AD structure.

So you think the only solution is to remove the tools and either restrict install or live with it?


0
 
LVL 26

Expert Comment

by:MidnightOne
ID: 19031462
Here's a possibility to add to the logon script, presuming you can put the admin tools installer in the netlogon foloder

msiexec /x %logonserver%\netlogon\adminpak.msi /qn /quiet

This performs an immediate stealth uninstall of the admin tools.

HAND

MidnightOne
0
 
LVL 14

Author Comment

by:top_rung
ID: 19031671
haha, that's cool and funny.  They will install it repeatedly and it will be removed everytime they log on.  The only problem with that is they will install it after they are logged on and use it during that session :-\

I am going to try that (at the least) to see how annoyed they get with it.  
0
 
LVL 26

Accepted Solution

by:
MidnightOne earned 2000 total points
ID: 19031696
Unless you have either the political backing to cause the developers great pain if they persist or the go-ahead to remove them from the local administrator's group of their systems, you're pretty much out of luck.

MidnightOne
0
 
LVL 14

Author Comment

by:top_rung
ID: 19033483
That is the answer I needed.  Pretty crummy that is works that way.  

Thanks for you suggestions!

0

Featured Post

Enroll in August's Course of the Month

August's CompTIA IT Fundamentals course includes 19 hours of basic computer principle modules and prepares you for the certification exam. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A hard and fast method for reducing Active Directory Administrators members.
Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question