Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to prevent users from looking up the membership of groups that they are not members of.

So for example,

Bob is in GroupA but not GroupB, so if Bob were to look at properties in AD he would see all the members of GroupA but non of the members of GroupB.

This is part of a QA test for software that enumerates groups using IADsGroup.IsMember. The output of calling that if the group permissions are correct is an exception, but I cannot replicate the AD conditions to generate that exception.

share|improve this question


You are going to have to modify the permissions on the Group object that you don't want everyone else being able to peek into.

One way to do this is in Active Directory Users and Computers. Make sure "View Advanced Features" is on. Now you can view the security settings of each Security Group object. Notice that "Authenticated Users" has Read permissions by default. You will have to change that if you don't want all Authenticated Users being able to read from the Group object.

This is going to involve a permissions design strategy to implement this just the way you want. You're going to have to plan things out, and as always, please be careful modifying default settings such as these on AD objects. Don't cause an URLT event. (Update resume; leave town)

Edit: So to elaborate a little more on your particular scenario. You might consider adding GroupA to the ACL of GroupB and checking Deny for the read privilege. Deny always takes precendence over Allow permissions, so that should effectively stop GroupA's ability to read from the GroupB object.

share|improve this answer
appreciate the concern! this is in a QA environment, and it's a secondary AD domain there, so there is very little chance of the URLT – warrenkopp Aug 22 '12 at 18:45
Awesome. I made a small edit that speaks a little more toward your specific scenario. – Ryan Ries Aug 22 '12 at 18:50
Just a note that an Explicit Allow takes precedence over an Inherited Deny... and vice versa. – joeqwerty Aug 22 '12 at 18:55
@joeqwerty: Thanks - and that perfectly reinforces my sentiments that Windows permissions are extremely flexible, and can also be extremely complex if you want them to be. – Ryan Ries Aug 22 '12 at 19:00
Truer words were never spoken. :) – joeqwerty Aug 22 '12 at 19:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.