I am working with an application that allows security to a hierarchy of folders to be set through Active Directory. I have run into an issue with the application where it seems that the default security mode for all users is full access, and only those users that are deliberately excluded will not be able to receive access. So I would thus like to set the permissions so that all users/groups in a domain are excluded, and then explicitly include the groups and users that should have access.

So my question: is there a way that I can refer to all groups and/or users within Active Directory? For domain ABC, and user XYZ, I would input ABC\XYZ. Same for a group. Is there a syntax like ABC\* that would be a blanket reference to all users and groups for the domain? Or would I have to go in and exclude them all explicitly?

  • I don't have a full reply to you, but a lead. AD is LDAP. It is queried just like any other LDAP. You will have to find the LDAP "recipe" that suits your needs. – user1797 May 7 '09 at 15:13

"Authenticated Users" includes all domain users, not sure if this would be available within your application but it works for group policies.

| improve this answer | |
  • 5
    Another option is "Domain Users" (I would add this through an edit, but don't have enough rep yet) – Yaakov Ellis May 7 '09 at 15:20
  • 1
    Authenticated Users didn't work for me on 2011 but Domain Users did, thanks for the add on. – Sirens Aug 8 '17 at 16:38

"Everyone", "Domain Users" or "Domain Admins" etc. are other ways to reference your users.

See this article with more info (I think it is still valid today)

Important text:

However, if you've enabled the Guest account, you'll find that users who have logged on as Guest are members of Everyone but not members of Users or Authenticated Users.

| improve this answer | |
  • link is dead... – Newtopian Feb 13 '18 at 15:38

Perhaps you can use the "Authenticated Users" system group? If I remember correctly, Active Directory uses a "deny by default" rules where it will only allow access to those specifically granted access in the ACL for an object. If you only want to allow certain users or groups, clear the list and add only those that you want to have access with the permissions desired. If there is a specific user that you do not want to have access that is part of a group that otherwise would have access, add them to the list with a specific "deny all" rule which will override the group setting for that user.

| improve this answer | |

If you are dealing with NTFS permissions, your model will not work. If you deny everyone access, then allow certain users, the deny will take precedence.

You need to remove the default access, and then allow certain users. Windows NTFS will only allow access if someone has been explicitly granted the rights - you don't need to explicitly deny them if you don't want.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.