Forum Discussion
Solved
Hiding Specific Attributes on all User Objects
I have a requirement an account i have to hide all attributes on the user object excluding a few, I have created the account to which restricted access is to be given I have tried with DENY Everyth...
- This is what i have done created a new ou directly under the domain
and have set this "descendant user objects" DENY all permissions and DENY all properties
still company division readable by the user for whom these permissions are set
I figured the reason why it is working it is due to similar permissions which are assigned to
“authentication users” and
“Pre-Windows 2000 Compatible Access (DOMAIN\Pre-Windows 2000 Compatible Access)”
Once I removed these from the user, no attributes are visible
PS C:\> Add-ADPermission –identity "NT AUTHORITY\Everyone" -user "restrictedAcc" -Deny -AccessRights ReadProperty -Properties division,company,changepassword -DomainController dc01
This is what i have done created a new ou directly under the domain
and have set this "descendant user objects" DENY all permissions and DENY all properties
still company division readable by the user for whom these permissions are set
I figured the reason why it is working it is due to similar permissions which are assigned to
“authentication users” and
“Pre-Windows 2000 Compatible Access (DOMAIN\Pre-Windows 2000 Compatible Access)”
Once I removed these from the user, no attributes are visible
and have set this "descendant user objects" DENY all permissions and DENY all properties
still company division readable by the user for whom these permissions are set
I figured the reason why it is working it is due to similar permissions which are assigned to
“authentication users” and
“Pre-Windows 2000 Compatible Access (DOMAIN\Pre-Windows 2000 Compatible Access)”
Once I removed these from the user, no attributes are visible
