Do users on a machine that runs Windows Sevrer 2008 R2 and is part of an Active Directory Group have access to the ActiveDirectory, e.g. read out attributes of AD records etc. on the DC?
If they can read such information, how can I prevent them from doing so?
I would like to add a custom attribute to the user class which contains a secret used for encryption and decryption. This should of course not be public to any other users.