Solved

Hiding user information in Active Directory

Posted on 2014-10-07
4
101 Views
Last Modified: 2014-10-14
I have a complex issue I need help resolving.  I have multi-domain organization with an account domain that has all the users (30,000) within that domain.  A 3rd party company is requesting we place a r/w DC in their data-center to access a Citrix application.  The problem is that this domain consists of multiple law enforcement agencies and we need to hide personal data not allowing non-law enforcement to be able to view their personal information.  The law enforcement personnel are very concerned with non-law enforcement having access to personal data.  I need to get this done in the most efficient way.

If you need more information please let me know.
0
Comment
Question by:Jim Wobig
  • 2
4 Comments
 
LVL 57

Expert Comment

by:Mike Kline
ID: 40367095
Definitely a complex issue and understandable request.    You can take advantage of the Filtered Attribute Set with the RODC.   You will need to make sure to test this and make sure you are filtering exactly what you want.  You can search for RODC and Filtered Attribute Set but some decent links:

http://technet.microsoft.com/en-us/library/cc753459%28v=ws.10%29.aspx

http://www.frickelsoft.net/blog/?p=202

http://blogs.msdn.com/b/canberrapfe/archive/2011/07/08/adding-attributes-to-the-rodc-filtered-attribute-set.aspx

Thanks

Mike
0
 

Author Comment

by:Jim Wobig
ID: 40367118
Thanks for the response Mike.  The company that is hosting the Citrix application is telling us RODC is not an option.  They also wont let us authenticate over the WAN and claim that it causes them to reboot their servers daily.

Thanks again,

Jim
0
 
LVL 79

Expert Comment

by:David Johnson, CD, MVP
ID: 40367331
Then obviously this 3rd party is not for your organization, either do it in house or find someone else.
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 500 total points
ID: 40367404
That is fine, you can hide with r/w DCs too.  Guido (DS MVP) has a great series on this

http://windowsitpro.com/active-directory/hiding-active-directory-objects-and-attributes

Other three parts are also there.  Again same as before...test test test.  

Thanks

Mike
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question