• State Not Answered
  • Replies 5 replies
  • Subscribers 63 subscribers
  • Views 94 views
  • Users 0 members are here
Options
Related

Remove Member Of

craig mcfarlane
16 hours ago

Hi Team. 

I am just looking for suggestions on overcoming a minor issue. 

Let's say I have the following. 

UserA and UserA is a member of GroupA

We have a secure T0 area in our AD, and we have not allowed anyone in GroupA to change the accounts that are in T0. However, because UserA can add members to groups outside of T0, they also seem to be able to add T0 accounts to the groups. 

Is there a way to deny Add on Member of for accounts in a certain OU if the person making the change is in GroupA

Thanks in advance 

Parents
  • 0 16 hours ago

    Think i have it unless there is a better way. 

    So if I Deny Read \ Write to the Member of attribute on the user account, then it works. The person can still go through the process of adding a group, but as soon as they click apply, the change is not saved. Is this the best way or is there something better? 

Reply
  • 0 16 hours ago

    Think i have it unless there is a better way. 

    So if I Deny Read \ Write to the Member of attribute on the user account, then it works. The person can still go through the process of adding a group, but as soon as they click apply, the change is not saved. Is this the best way or is there something better? 

Children