Prevent AD users from seeing group members?

Question

I need to prevent users from looking up the membership of groups that they are not members of.

So for example,

Bob is in GroupA but not GroupB, so if Bob were to look at properties in AD he would see all the members of GroupA but non of the members of GroupB.

This is part of a QA test for software that enumerates groups using IADsGroup.IsMember. The output of calling that if the group permissions are correct is an exception, but I cannot replicate the AD conditions to generate that exception.

Answer 1

Yes.

You are going to have to modify the permissions on the Group object that you don't want everyone else being able to peek into.

One way to do this is in Active Directory Users and Computers. Make sure "View Advanced Features" is on. Now you can view the security settings of each Security Group object. Notice that "Authenticated Users" has Read permissions by default. You will have to change that if you don't want all Authenticated Users being able to read from the Group object.

This is going to involve a permissions design strategy to implement this just the way you want. You're going to have to plan things out, and as always, please be careful modifying default settings such as these on AD objects. Don't cause an URLT event. (Update resume; leave town)

Edit: So to elaborate a little more on your particular scenario. You might consider adding GroupA to the ACL of GroupB and checking Deny for the read privilege. Deny always takes precendence over Allow permissions, so that should effectively stop GroupA's ability to read from the GroupB object.