Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I currently manage multiple environments on a single domain. We are beginning to publish out MMC's and give local admin access to the IT contact for the clients. This includes ADUC and Event Viewer, etc.

Does anyone know of a way to remove the connect to other computer option in the MMC? We are hoping to lock down the browsing abilities on the domain so that one client cannot see another client's servers in AD?

share|improve this question

2 Answers 2

I think you cannot remove the connect to another option. And even if you can, what happens if one user create a console a bring it in your network by a flash memory?

You have to work in the permissions and rights of your servers.

share|improve this answer

You need to delegate permissions appropriately, or break these clients out into child domains. Just because you disable that in the MMC snap-in doesn't stop them from doing something like Get-ADComputer -Filter * in powershell or using a similar dsquery command.

A fence with 100 holes isn't secure if you fix a single one.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.