Hiding Specific Attributes on all User Objects

[Himanshu Singh]

I have a requirement an account i have to hide all attributes on the user object excluding a few,

I have created the account to which restricted access is to be given

I have tried with DENY Everything on the OU under which i have users,

still the user is able to read at least 20-25 or few more attributes in,

Which is also clearly shown when effective permissions is checked, but then how does this works

[#2]

PS C:\> Add-ADPermission –identity "NT AUTHORITY\Everyone" -user "restrictedAcc" -Deny -AccessRights ReadProperty -Properties division,company,changepassword -DomainController dc01

[#3 · Accepted solution]

This is what i have done created a new ou directly under the domain
and have set this "descendant user objects" DENY all permissions and DENY all properties
still company division readable by the user for whom these permissions are set

I figured the reason why it is working it is due to similar permissions which are assigned to
“authentication users” and
“Pre-Windows 2000 Compatible Access (DOMAIN\Pre-Windows 2000 Compatible Access)”
Once I removed these from the user, no attributes are visible

[#4]

@Himanshu Singh