[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 176
  • Last Modified:

custom msc file allows browsing Domain

Hi -

I'm using Windows Server 2008R2, domain level is native 2008R2.  I have created a custom .msc file for one of my junior admins, and it works just fine.  This console is designed to let them change/reset passwords for users in a specific OU.  I authored the .msc, then saved it using "User mode - limited access, single window" Console mode, and I've also deselected the "Allow the user to customize views" option.  

However, if the admin goes into the "view" settings, and selects View then Advanced Features, the console goes to the Console Root, and they are back at the top of my domain OU structure for Active Directory Users and Computers, at which point they can browse through the entire domain structure.  I obviously don't want that.  

It seems that something is not functioning properly - is there something I'm missing?

Thanks in advance,
Matt
0
charter_oak
Asked:
charter_oak
  • 4
  • 3
1 Solution
 
McKnifeCommented:
You might be missing, that with default permissions, anyone may do that. So you would need to modify the OU permissions.
0
 
charter_oakAuthor Commented:
Thanks for the response, but I really don't think the OU permissions should need to be adjusted - that's what the msc is supposed to do.

The .msc shouldn't allow the user to get to view that level, though - that's what the "limited access" mode should be doing - according to Microsoft -

http://support.microsoft.com/kb/230263

"User Mode-limited access, single window: All restrictions in place for multiple window limited-access user mode apply, except that there is only a single window, so the controls for working with multiple windows are not present."
0
 
McKnifeCommented:
Thing is: take any user. He may browse AD by default.
0
Free tool for managing users' photos in Office 365

Easily upload multiple users’ photos to Office 365. Manage them with an intuitive GUI and use handy built-in cropping and resizing options. Link photos with users based on Azure AD attributes. Free tool!

 
charter_oakAuthor Commented:
I know that.  The tool is still not working as described.
0
 
McKnifeCommented:
Sorry for not coming back to you, was on vacation and mostly offline.
Maybe that's a bug. But: Assuming it could work: what would keep your junior admin from using the search in network neighborhood or even creating his own msc to view the things you are trying to keep him away from? Only modifying the OU permissions would help, I think.
0
 
McKnifeCommented:
I wonder how you think about my last comment - that seems to be the solution for reasons given.
0
 
charter_oakAuthor Commented:
No other solutions offered
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now