Solved

custom msc file allows browsing Domain

Posted on 2014-02-21
7
166 Views
Last Modified: 2014-03-21
Hi -

I'm using Windows Server 2008R2, domain level is native 2008R2.  I have created a custom .msc file for one of my junior admins, and it works just fine.  This console is designed to let them change/reset passwords for users in a specific OU.  I authored the .msc, then saved it using "User mode - limited access, single window" Console mode, and I've also deselected the "Allow the user to customize views" option.  

However, if the admin goes into the "view" settings, and selects View then Advanced Features, the console goes to the Console Root, and they are back at the top of my domain OU structure for Active Directory Users and Computers, at which point they can browse through the entire domain structure.  I obviously don't want that.  

It seems that something is not functioning properly - is there something I'm missing?

Thanks in advance,
Matt
0
Comment
Question by:charter_oak
  • 4
  • 3
7 Comments
 
LVL 54

Expert Comment

by:McKnife
ID: 39877873
You might be missing, that with default permissions, anyone may do that. So you would need to modify the OU permissions.
0
 

Author Comment

by:charter_oak
ID: 39878189
Thanks for the response, but I really don't think the OU permissions should need to be adjusted - that's what the msc is supposed to do.

The .msc shouldn't allow the user to get to view that level, though - that's what the "limited access" mode should be doing - according to Microsoft -

http://support.microsoft.com/kb/230263

"User Mode-limited access, single window: All restrictions in place for multiple window limited-access user mode apply, except that there is only a single window, so the controls for working with multiple windows are not present."
0
 
LVL 54

Expert Comment

by:McKnife
ID: 39878832
Thing is: take any user. He may browse AD by default.
0
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 

Accepted Solution

by:
charter_oak earned 0 total points
ID: 39879347
I know that.  The tool is still not working as described.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 39898526
Sorry for not coming back to you, was on vacation and mostly offline.
Maybe that's a bug. But: Assuming it could work: what would keep your junior admin from using the search in network neighborhood or even creating his own msc to view the things you are trying to keep him away from? Only modifying the OU permissions would help, I think.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 39932754
I wonder how you think about my last comment - that seems to be the solution for reasons given.
0
 

Author Closing Comment

by:charter_oak
ID: 39944763
No other solutions offered
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This article explains how to install and use the NTBackup utility that comes with Windows Server.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question