[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 59
  • Last Modified:

2003 Server AD Permissions & Security

Have Windows 2003 server w/AD. Creating a new directory structure and wanted to know if it is possible to not let user view directories under a parent, that they don't have permissions to access?
0
Harold
Asked:
Harold
  • 7
  • 5
3 Solutions
 
Will SzymkowskiSenior Solution ArchitectCommented:
Are you meanng something like (Access Based Enumeration like how DFS has)? So you only want to show the directory structure where users have access to?

domain.com
+---OU1 (has permission)
+-------OU2 (has permission)
+-----------OU3 (does not have permission)

+---OUA (has permission)
+-------OUB (does not have permission)
+---------OUC (does not have permission)

So if this is the case above you User1 would only see OU1/OU2 and OUA and nothing else.

If this is what you are looking for, then it is not possible. At the top level domain Everyone has Read All Properties by default and you do not want to change these settings. This allows anyone (who is a domain member) to look up attributes for users/computers and other services that may be associated wth there account like Exchange or Lync.

Changing these settings could have a negative impact on your environment and any services that you are hosting.

Will.
0
 
HaroldNetwork EngineerAuthor Commented:
@Will: How can I make them not able to read the content of folders then?
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
Content of what folders? Are you referring to the OU's in AD or something else?

Will.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
HaroldNetwork EngineerAuthor Commented:
Any folder they are not to view content. Currently they can still read, where I don't need them to read.
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
Are you talking about OU's or Folders (like on a file server)?

I would not be modifying the read permissions on OU. But if you need to for whatever reason, you need to enable Advance Features within ADUC and then go to the OU that you want to modify security to,
- click the security tab
- click the advance tab
- remove the check mark for "include inheritable permissions of the objects parent"
- On the Next Window clcik the ADD button
- Remove the permissions for Everyone and or the user account you do not want to have access

Will.
0
 
HaroldNetwork EngineerAuthor Commented:
@Will; I was referencing the folders. Everyone still can read the content of the Folders/Files.
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
Oh, ok sounds good.

You would still follow the directions above but doing this at the folder level. If you have Everyone at the root folder and you just want to modify some of the child folder to not allow Everyone read permissions you need to go to that folder and proceed with the steps above, removing the "include inheritable permissions of the objects parent" and then clicking the Add button and then you can remove the Everyone Group from this directory.

Will.
0
 
HaroldNetwork EngineerAuthor Commented:
@Will; I think I figured out the Folder access problem I was having. Everyone had inherited permissions from the Parent folder, I removed "Allow inherited......" then added the group I wanted and gave their permissions there.
0
 
HaroldNetwork EngineerAuthor Commented:
@Will; you must have been typing the same time I was, thanks for all Will, great help.

Going to post a question on login.bat files shortly, if you're interested.
0
 
HaroldNetwork EngineerAuthor Commented:
thanks again Will.
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
Not a problem. Send me the link and i will happily assist.

Will.
0

Featured Post

Veeam and MySQL: How to Perform Backup & Recovery

MySQL and the MariaDB variant are among the most used databases in Linux environments, and many critical applications support their data on them. Watch this recorded webinar to find out how Veeam Backup & Replication allows you to get consistent backups of MySQL databases.

  • 7
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now