1

I know how to restrict individual users from accessing/reading OUs or folders in Active Directory.

This page provides a good guide on how to do this.

But how can one bar the users of an entire OU, and its child OUs from accessing a particular folder? Security options seem to apply only to individual users and groups...

Improve this question

1 Answer 1

Reset to default
5

You are correct, in Active Directory Users only inherit security principles from Groups. Organizational Units do not inherit to their contained users.

At an old employer we solved this problem with a nightly batch process that builds per-OU groups.

Improve this answer
2
  • What sort of technique did you use to build this sort of batch process?
    – Stumbler
    Commented Jun 13, 2013 at 8:32
  • 1
    Pretty simple really. Used dsget to build a list of 'users in this OU and under', then piped it into dsmodify to update the OU-Group. Doing it overnight means that users are in the group at morning login time.
    – sysadmin1138 ♦
    Commented Jun 13, 2013 at 11:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .