Hide OUs in Active Directory Users and Computers

I want to delegate permissions to an admin in Active Directory Users and Computers.  I also don't want the admin to see any other containers than the one that is being delegated to him.  Is this possible?
ENTPFAsked:
Who is Participating?
 
minvisCommented:
It can easily be done with MMC.

Open "Active directory users and computers" snap-in in the MMC. Right-click the OU you've delegated en choose open in new window. Close the other window in MMC and save the console as an *.msc file.

If anyone opens this file he/she will see only one OU.

Good luck!
0
 
DenverRickCommented:
No.  You can prevent the access by him but he will still see the the containers.  There is no "hidden" feature like there is for Folder shares.
0
 
LauraEHunterMVPCommented:
Actually it is possible, but -extremely- non-trivial. By default, the Authenticated Users group has Read access to nearly the entire directory. You can remove this permission at the domain level and assign Read permissions manually at lower OU levels, but it needs to be carefully tested in a lab environment before deploying to production, as it has the potentical to break a -lot- of applications, including Group Policy.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
DenverRickCommented:
Totally unsupported.
0
 
LauraEHunterMVPCommented:
Totally incorrect - google "Confidentiality bit" for some examples, or come to the Directory Experts Conference most years to listen to Guido Grillenmeier or someone else from HP present on it.  Any number of organizations have implemented it, but it is absolutely something that must be done with care and with significant testing.
0
 
DatagoCommented:
The "Acceptde Solution" is is not completely correct infact if a domain user install Windows Server 2003 Administration Tools Pack or RSAT can see all ad ou, users, ou and computers.
0
 
khairilCommented:
Hi,

Datoga comment is right, unless you can program youself special tools, having delegation does not mean that all other OUs and it contents are hidden from the user. They just not be able to change/delete it.

-khairil-
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.