1

I currently manage multiple environments on a single domain. We are beginning to publish out MMC's and give local admin access to the IT contact for the clients. This includes ADUC and Event Viewer, etc.

Does anyone know of a way to remove the connect to other computer option in the MMC? We are hoping to lock down the browsing abilities on the domain so that one client cannot see another client's servers in AD?

2 Answers 2

2

I think you cannot remove the connect to another option. And even if you can, what happens if one user create a console a bring it in your network by a flash memory?

You have to work in the permissions and rights of your servers.

1

You need to delegate permissions appropriately, or break these clients out into child domains. Just because you disable that in the MMC snap-in doesn't stop them from doing something like Get-ADComputer -Filter * in powershell or using a similar dsquery command.

A fence with 100 holes isn't secure if you fix a single one.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .