up vote 0 down vote favorite
share [g+] share [fb]

Do users on a machine that runs Windows Sevrer 2008 R2 and is part of an Active Directory Group have access to the ActiveDirectory, e.g. read out attributes of AD records etc. on the DC?

If they can read such information, how can I prevent them from doing so?

I would like to add a custom attribute to the user class which contains a secret used for encryption and decryption. This should of course not be public to any other users.

link|improve this question
86% accept rate
2  
What attributes are you concerned about them reading? Authenticated users have privileges to read a lot of things by default, but not everything (e.g.passwords). – Zoredache Nov 2 '11 at 8:04
I have clarified my post – Heinrich Nov 2 '11 at 16:40
1  
possible duplicate of Where do I store sensitive data within Active Directory? – mfinni Nov 2 '11 at 17:24
feedback

1 Answer

up vote 3 down vote accepted

If they are local users on the server, then no. If they are AD users, then yes. If they are local users and the local user accounts are members of an AD group, then possibly.

One way to find out is by using effective Permissions in advanced security. This will display exactly what permissions a user has over a specific item (e.g. file share, another user object, etc.).

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.