1

I am an Exchange 2010 administrator. I know users can be hidden from the GAL using the Exchange Management Console.

Is it possible to hide a phone number of a user in the GAL from certain users?

Example: John Doe exists in the GAL and I can see his phone number because I am a member of a certain AD group. People not in my AD group cannot see John's phone number.

3
  • I don't believe this is possible, using native tools.
    – mfinni
    Nov 4, 2014 at 21:39
  • 3
    As I put at the end of my answer, if you have any employees who can't be trusted with another employee's phone number, FIRE THEM instead of doing permissions gymnastics with Active Directory object attributes. Nov 4, 2014 at 22:31
  • @mfinni It's possible... you can control who can see which attributes on arbitrary AD objects, should you be so inclined/masochistic/insane... it's just never worth the effort, or the best approach, etc. Nov 4, 2014 at 22:39

1 Answer 1

2

Yeah, it's possible... but not in a way that makes it worth doing, in my opinion.

You can, on any Active Directory object, granularly control who can read which attributes. On the person whose phone number you want to hide, you would need to:

  1. Remove the default Allow permissions that Authenticated Users have to read the attribute in question.
    • By default, Authenticated Users can Read all properties of other Active Directory users, so you need to go to the user whose phone number you want to hide and remove those default Read all properties permissions.

  2. Replace those removed permissions with read permissions for the attributes you want "everyone" to be able see (which is probably/generally everything except the phone number).

  3. Manually allow the desired group or user(s) permission to view the attribute where the phone number in question is stored. The "primary" attribute is Telephone-Number, but there are a bunch of other ones too... off the top of my head, Mobile Number, Home Phone, Home Phone Number (Others), IP Phone Number, IP Phone Number (Others), and Phone Number (Others). Screenshot from ADSI edit:

enter image description here

Having said that, it's much easier, and much better to just fire any moron who demonstrates that they can't be trusted with someone's telephone number. This approach also has the advantage of not being counter to stated Microsoft best practices.

3
  • That's in AD. The offline address book is generated by exchange which can read all those attributes though, right?
    – mfinni
    Nov 4, 2014 at 22:41
  • I'm not aware of any acl entries that can be put on GAL entities
    – mfinni
    Nov 4, 2014 at 22:43
  • 1
    @mfinni Well, now you're gonna go and make me double-check, but isn't the GAL just a AD-query? You may be right about the offline address book, but I know I've done this before for the GAL... several years ago, before I learned the phrase "no, that's insane." Nov 4, 2014 at 22:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .