In my home lab I'm trying to reduce the scope of executed PowerShell scripts.

My Active Directory organization unit (OU) structure looks like this:


Executing the command:

wmic useraccount get name

Lists all user accounts in my Active Directory.

I want to reduce the scope of the OU. Users in the OU "Customer1 > users" should only be able to retrieve users in the same OU.

Modification of the OU security settings resulted in not applying several GPOs.

How can I achieve this ? Is there a best practice ?


It sounds like you need to delegate control of your OUs. To do this don't adjust the security tab directly, instead use the delegation of control wizard.


The delegation of control wizard will allow you to delegate all the access that is required for your OU. you will also need to make sure that you restrict access to the Operator groups as well as the administrator groups.

one final note, if these OUs are intended for different customers I would recommend that each customer gets their own forest. An AD forest is not multi-tenancy. It will be very difficult to fully isolate each customer inside the same forest. Also if you lost one of the customers they would loose their AD Domain. By giving each customer their own forest you will get full isolation and in the event that you loose a customer they can keep their AD Forest.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.