For LDAP queries I created a special account (domain user) located in : OU=work, CN=do, CN=apropos, CN=tev How can I restrict the read permission of this account to just: OU=trouble, OU=now, CN=do, CN=apropos, CN=tev

Many Thanks


This is not easy as it seems, because the default permissions grant read access on all OUs to all authenticated users, regardless of group membership; in order to achieve what you want, you need to either modify the default permissions (with possible heavy impact on various applications), or use explicit deny ACEs for your restricted users.

See here for more info: http://windowsitpro.com/active-directory/hiding-data-active-directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.