Domain Guests can browse AD - why ???

[gmail2]

I'm trying to tie down my AD as much as possible to prevent anybody from being able to get a list of employees from AD etc. I have 2 scenarious in which I want to prevent this at the moment:

1. A service account which is used to create an LDAP bind to authenticate our remote dial-up users
2. Vendors who need local admin access to certain servers, but do not need any permissions to browse AD

For the first scenario, I removed the service account from domain users and added to the domain guests account instead. Then I changed the permissions on the Dial Up Users OU so that the service account had read permissions. I assumed that the account would not be able to browse any other OU ... but I was wrong !! The service account can still browse all other OU's in Active Directory. Why ... it's a domain guest ?!?!?!?!

My plan was when I had this working to implement something similar for the second scenario. But now that I've discovered my domain guests can browse AD, that's out the window. Has anybody got any ideas why domain guests can do this? Is it a mis-configuration on my part? Or are the domain guests part of the Authenticated Users group by default?

Thanks in advance for any help

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[gmail2]

Please .... can anybody help with this at all ? I'm really curious/frustrated that users I specify as "guests" can access resources in AD without me explicity giving them permissions to. Any help would be greatly appreciated

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[bprox]

By default, all Authenticated Users have Read access to AD and all of the containers within it. You may be able to restrict your users that were put into the "Domain Guests" group by adding the group to the OUs and setting Deny - Read on the ACL.
I would recommend you create a Test OU and a Test user to verify this works as intended before applying it to your production environment.

Thanks,

Boe