Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm not well-versed in AD, so would like to resolve a question I have with regards to AD information.

I understand that it is possible to apply group policy to OU's, thereby restricting access. What I'd like to know is, is it possible to do the same with OU attributes.

Some context would help. There's a requirement to store address information in AD (IMO, a natural fit), but for various reasons, although obviously things like name should be globally accessible, access restrictions are desired on the address. In this case, is it possible to apply security to the address portion of the OU attributes, or does each address have to be broken into a separate OU (a solution that feels smelly given that address doesn't have identity)?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Group Policies are not what you are looking for here - what you want to look at are access rights and permissions on the various objects and more specifically the relevant attributes of those objects that you want to restrict access to. There is a good article on the fundamentals around DACL's and AD objects\attributes here although it is quite old it does explain how you can approach modifying them. You should take care when playing with these - the inheritance\replication behavior of ACL's in the AD makes things behave somewhat differently to what you might be used to with DACL's and NTFS and if you make a mistake you might end up breaking quite a lot of stuff.

share|improve this answer
    
Thanks - the article that you linked to is useful, and does indicate that ACL's can be applied to attributes. –  Eric Smith Jan 14 '10 at 6:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.