I have a requirement to change some settings in the security tab of user accounts in Active Directory for a large group of people. I need to give Everyone Access to specific Read Settings under the Security tab of a user account.

Is there a better way to manage this than having to go into Active Directory > View > Advanced Features > Open User Account > Security Tab; then adding the check marks for each of the Permissions for Everyone to each of the users? This also needs to be applied to new user accounts moving forwards.


The specific permissions are the advanced permissions, not just read. I need to add Authenticated Users to be able to: Read account restrictions, Read general information, Read logon information, read group information, read phone and mail options, read private information.

I tried to setup a new OU. But I don't have those advanced security settings under the new OU.

  • Can you detail the exact permission configuration you need for these users? – jscott Dec 21 '12 at 18:08
  • 1
    Are you sure this cannot be handled by putting these users within an OU, and then setting the permissions on the OU properly? – Zoredache Dec 21 '12 at 18:14
  • @Zoredache would that propagate down to the objects under it? I need to test that. This could be what I'm looking for. I'll let you know. Thanks – Nixphoe Dec 21 '12 at 18:16
  • ADSIedit, or PowerShell? – HopelessN00b Dec 21 '12 at 18:18
  • @HopelessN00b I tested ADSIedit, and it doesn't have the advanced security settings like I outlined in my edit. Any ideas how I would be able to use powershell to do this? – Nixphoe Dec 26 '12 at 16:45

You should be able to use Delegation of Control to delegate the required READ permission(s) to the Everyone group on User objects. If you set it at the domain root it should be inherited by all child nodes in the domain, avoiding the need to manually set the permissions on existing objects or new objects..

  • 1
    The delegation wizard is nice but it can't undo or revert changes it makes. For bonus points, the READ rights could be delegated to a group, then Domain Users could be made a member of that group. – Nic Feb 8 '13 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.