How to deny a read access to an object's attribute in AD

  • Thread starter Thread starter =?ISO-8859-2?Q?Ji=F8=ED_Jany=B9ka?=
  • Start date Start date
?

=?ISO-8859-2?Q?Ji=F8=ED_Jany=B9ka?=

Hi,

We're going to use the "Otherpager" attribute of User objects in our
Active Directory for storing an information, that shouldn't be available
for reading to most users (only Admins should have read/write access).
By default it is available to everyone like other attributes are.
I'd like to know, if the following method is correct, eventually if
there is a simpler way...

AD Users&Computers

- right-click on our domain name, Properties
- Security card
- Advanced button

- in the table of permissions select "Allow | Everyone | Read All
Properties ..."
- Edit button
- Properties card
- select Apply onto "User objects"
- uncheck "Allow" checkbox for "Read Pager Number(Others)"
- check the "Apply these permissions to objects and/or containers within
this container only" checkbox (needed ?)
- confirm OK a few times

- repeat the same steps for "Allow | Authenticated Users | Special ..."
(needed ?)


All permissions are still intact, I don't have any "test environment"
here and I'm a bit afraid of screwing up something... ;-)


Thanx for any comments !
 
Back
Top