Delegating Control.

[stvleaze]

Hello all. I am searching for ways to deligate control to certain dept. heads. I want to have a snap in on their xp machines that shows them just their OU. Is this possible?

I installed ADMINPAK.MSI but that showed way too much. It shows the entire AD structure. That brings me to another question. I tested installing ADMINPAK.MSI on a simply pc with a simple domain user. BAM I could see the entire AD structure.. All OU's and all users.. everything... Is this normal? I would rather keep this stuff hidden..

Anyways, if anyone has any suggestions I would appriciate them. Thanks!!

Daniel

 

[TaylorDavidI]

You can create a new mmc snap in that shows only the appropriate OUs, you may need to create more than one if each department head has a different OU.

Make sure to go into options under the file menu and change it to user mode rather than author mode.

It might also help if you right click the appropriate OU and select "New Window From Here" then you can close the main window and they won't have access to anything higher in the tree. Save it and deploy it to their stations.

David I. Taylor
A+, Network+, MCP Windows XP

 

[stvleaze]

Thanks. I got that down. But that still doesn't keep someone it savy from installing ADMINPAK.MSI and seeing the entire AD layout.

What keeps kids from doing this at colleges that use AD.
Im sure they dont want the entire school AD scheme public. There has gotta be a way to hide that even if someone downloads and installs ADMINPAK.MSI.

 

[TaylorDavidI]

The first way would be to simply not allow anyone other than the IT department to have power user or administrative rights to their local machines. This will prevent them from installing anything.

The next would be to put a GPO in place with a software restriction rule that prevents any of the mmc snap ins from ADMINPAK from loading... I'm not really certain if this will prevent the use of the custom consoles.

I'm sure there are others, perhaps far better than my suggestions.

David I. Taylor
A+, Network+, MCP Windows XP