I'm not well-versed in AD, so would like to resolve a question I have with regards to AD information.

I understand that it is possible to apply group policy to OU's, thereby restricting access. What I'd like to know is, is it possible to do the same with OU attributes.

Some context would help. There's a requirement to store address information in AD (IMO, a natural fit), but for various reasons, although obviously things like name should be globally accessible, access restrictions are desired on the address. In this case, is it possible to apply security to the address portion of the OU attributes, or does each address have to be broken into a separate OU (a solution that feels smelly given that address doesn't have identity)?

1 Answer 1


Group Policies are not what you are looking for here - what you want to look at are access rights and permissions on the various objects and more specifically the relevant attributes of those objects that you want to restrict access to. There is a good article on the fundamentals around DACL's and AD objects\attributes here although it is quite old it does explain how you can approach modifying them. You should take care when playing with these - the inheritance\replication behavior of ACL's in the AD makes things behave somewhat differently to what you might be used to with DACL's and NTFS and if you make a mistake you might end up breaking quite a lot of stuff.

  • Thanks - the article that you linked to is useful, and does indicate that ACL's can be applied to attributes.
    – Eric Smith
    Jan 14, 2010 at 6:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.