4

I am in the process of delegating some Active Directory tasks to a group of users. These users do not have domain administration rights and will only perform tasks such as creating/disabling accounts in a single OU. I have two questions:

a) In order for the users to be able to perform these actions from their workstations, is there any other method other than installing the Remote Server and Administration Tools? Could I install only the 'Active Directory Users and Computers' snap-in somehow?

b) Despite creating a custom AD snap-in using mmc.exe so the single OU to be managed is at the root, I was surprised to see that users still had read-access to the whole AD domain structure. Is this by design or have my permissions gone awry somewhere?

Many thanks!

2
  • You can create custom taskpads as needed: windowsitpro.com/active-directory/… but yes users will have read access to the domain by default. BTW, there are 3rd party tools from various outfits that use a web interface to allow delegates just what they have access to as well.
    – TheCleaner
    Jun 17, 2013 at 21:48
  • Thank you everyone for your answers and comments. I thought as much; I guess AD is fully readable by definition - it is a directory. @TheCleaner - Thanks for the tip on 'Taskpads' - very cool.
    – chazjn
    Jun 18, 2013 at 12:40

3 Answers 3

4

a) In order for the users to be able to perform these actions from their workstations, is there any other method other than installing the Remote Server and Administration Tools? Could I install only the 'Active Directory Users and Computers' snap-in somehow?

ADUC is part of RSAT. They need that installed unless they want to use the commandline net use commands, which wouldn't be very efficient.

b) Despite creating a custom AD snap-in using mmc.exe so the single OU to be managed is at the root, I was surprised to see that users still had read-access to the whole AD domain structure. Is this by design or have my permissions gone awry somewhere?

This is normal and expected. Amost nothing is secret in your AD and there's really no reason for it to be in most cases. Even if you didn't install ADUC for these users (or any users) they could still gather information about your domain using dsquery, net use, or the Get-AD* PowerShell cmdlets.

Don't worry, nothing's gone wrong. That's how it should be.

5

Authenticated Users have READ permissions (along with a few other permissions) at the domain root by design. These permissions are inherited by all child objects in the domain (AFAIK) and are related to the operation of Active Directory, it's functions and it's objects. These permissions aren't directly related to Delegation of Authority.

0

You are on the right track. You should not worry about delegated admins having complete read access to the Active Directory, because in fact, virtually everyone i.e. all authenticated users already have full read access to the Active Directory, because it is after all a directory service, which is thus accessible to everyone.

In regards to the delegated admins have access to the entire functionality of ADUC/RSAT, even though the functionality might exist, if they don't have the underlying permissions to perform those tasks, they will not be able to perform these tasks, and thus they will not be able to do anything they do not have access to do.

So it is okay to let them use ADUC. All you need to ensure is that they only have least amount of permissions they need in Active Directory to fulfill their assigned responsibilities.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .