Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Do users on a machine that runs Windows Sevrer 2008 R2 and is part of an Active Directory Group have access to the ActiveDirectory, e.g. read out attributes of AD records etc. on the DC?

If they can read such information, how can I prevent them from doing so?

I would like to add a custom attribute to the user class which contains a secret used for encryption and decryption. This should of course not be public to any other users.

share|improve this question
What attributes are you concerned about them reading? Authenticated users have privileges to read a lot of things by default, but not everything (e.g.passwords). – Zoredache Nov 2 '11 at 8:04
I have clarified my post – Heinrich Nov 2 '11 at 16:40
possible duplicate of Where do I store sensitive data within Active Directory? – mfinni Nov 2 '11 at 17:24
up vote 3 down vote accepted

If they are local users on the server, then no. If they are AD users, then yes. If they are local users and the local user accounts are members of an AD group, then possibly.

One way to find out is by using effective Permissions in advanced security. This will display exactly what permissions a user has over a specific item (e.g. file share, another user object, etc.).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.