1

As I'm experimenting with a vanilla Active Directory domain, I notice that a standard user can go into Active Directory Users and Computers (dsa.msc) and Group Policy Management Console (gpmc.msc) and view the configuration in both of those respective services (AD and Group Policy).

Additionally, I also notice that a user can search for AD objects on the domain. Out of pure curiosity, how would I go about disabling user access to these if I were going to for security purposes while not breaking any other functionality?

I'm running Server 2016 with a Server 2016 functional forest and domain level. All hosts are either Server 2016 member servers or Windows 10 clients.

  • Viewing some domain objects is not likely your main concern; I would focus on other aspects of securing your environment - like restricting your administrative accounts - that is far far more troublesome that some users reading directory information. The other step would be not prohibit dsa.msc and gpmc.msc from running on user workstations. probably should also block dsac.exe and ldp.exe – Semicolon Feb 4 at 18:23
1

From this explanation of restricting rights in Active Directory:

By default, typical domain users have Read access to almost everything in AD domains—including users, groups, organizational units (OUs), and Group Policy Objects (GPOs).

...

The only way to restrict users is to restrict Read permissions on objects that you don't want users to be able to read. However, be judicious when restricting Read access to AD objects, or you might run into problems. For instance, if users don't have Read access to other user objects, they might not be able to use Microsoft Exchange Server to find mail recipients. And if you deny users Read access to GPOs, settings that you configure under User Configuration in those GPOs won't be applied.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.