Forum Discussion

Himanshu Singh's avatar
Himanshu Singh
Iron Contributor
Dec 12, 2018

Hiding Specific Attributes on all User Objects

I have a requirement an account i have to hide all attributes on the user object excluding a few,

I have created the account to which restricted access is to be given

I have tried with DENY Everything on the OU under which i have users,

still the user is able to read at least 20-25 or few more attributes in,

Which is also clearly shown when effective permissions is checked, but then how does this works

  • Himanshu Singh's avatar
    Himanshu Singh
    Dec 12, 2018
    This is what i have done created a new ou directly under the domain
    and have set this "descendant user objects" DENY all permissions and DENY all properties
    still company division readable by the user for whom these permissions are set

    I figured the reason why it is working it is due to similar permissions which are assigned to
    “authentication users” and
    “Pre-Windows 2000 Compatible Access (DOMAIN\Pre-Windows 2000 Compatible Access)”
    Once I removed these from the user, no attributes are visible
  • PS C:\> Add-ADPermission –identity "NT AUTHORITY\Everyone" -user "restrictedAcc" -Deny -AccessRights ReadProperty -Properties division,company,changepassword -DomainController dc01
    • Himanshu Singh's avatar
      Himanshu Singh
      Iron Contributor
      This is what i have done created a new ou directly under the domain
      and have set this "descendant user objects" DENY all permissions and DENY all properties
      still company division readable by the user for whom these permissions are set

      I figured the reason why it is working it is due to similar permissions which are assigned to
      “authentication users” and
      “Pre-Windows 2000 Compatible Access (DOMAIN\Pre-Windows 2000 Compatible Access)”
      Once I removed these from the user, no attributes are visible

Resources