Solved

custom msc file allows browsing Domain

Posted on 2014-02-21
7
167 Views
Last Modified: 2014-03-21
Hi -

I'm using Windows Server 2008R2, domain level is native 2008R2.  I have created a custom .msc file for one of my junior admins, and it works just fine.  This console is designed to let them change/reset passwords for users in a specific OU.  I authored the .msc, then saved it using "User mode - limited access, single window" Console mode, and I've also deselected the "Allow the user to customize views" option.  

However, if the admin goes into the "view" settings, and selects View then Advanced Features, the console goes to the Console Root, and they are back at the top of my domain OU structure for Active Directory Users and Computers, at which point they can browse through the entire domain structure.  I obviously don't want that.  

It seems that something is not functioning properly - is there something I'm missing?

Thanks in advance,
Matt
0
Comment
Question by:charter_oak
  • 4
  • 3
7 Comments
 
LVL 54

Expert Comment

by:McKnife
ID: 39877873
You might be missing, that with default permissions, anyone may do that. So you would need to modify the OU permissions.
0
 

Author Comment

by:charter_oak
ID: 39878189
Thanks for the response, but I really don't think the OU permissions should need to be adjusted - that's what the msc is supposed to do.

The .msc shouldn't allow the user to get to view that level, though - that's what the "limited access" mode should be doing - according to Microsoft -

http://support.microsoft.com/kb/230263

"User Mode-limited access, single window: All restrictions in place for multiple window limited-access user mode apply, except that there is only a single window, so the controls for working with multiple windows are not present."
0
 
LVL 54

Expert Comment

by:McKnife
ID: 39878832
Thing is: take any user. He may browse AD by default.
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 

Accepted Solution

by:
charter_oak earned 0 total points
ID: 39879347
I know that.  The tool is still not working as described.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 39898526
Sorry for not coming back to you, was on vacation and mostly offline.
Maybe that's a bug. But: Assuming it could work: what would keep your junior admin from using the search in network neighborhood or even creating his own msc to view the things you are trying to keep him away from? Only modifying the OU permissions would help, I think.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 39932754
I wonder how you think about my last comment - that seems to be the solution for reasons given.
0
 

Author Closing Comment

by:charter_oak
ID: 39944763
No other solutions offered
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A procedure for exporting installed hotfix details of remote computers using powershell
This article explains the steps required to use the default Photos screensaver to display branding/corporate images
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question