Domain lockdown and Enumation

AR has a white listing model - you always start with NO access.

I would avoid using Deny Access Templates unless absolutely necessary.  Rather, grant rights only on the OUs where you want to give access and turn off the inheritance of the access (or at least limit it to "immediate children only").

'Hope this helps.

Hey Johnny,

Yeah that's what I thought, When I set permissions on the domain and OU structures, I'm adding the "List Content" and "List"  for Domain and OU objects, this still doesn't let me see inside the OU. 

What I then did was allowed read access to the entire object structure, then I could populate the OUs without issue, but then so did the privileged OUs I wanted to omit so I did a deny.

So, I guess my new question is this, what is the absolute minimum I have to give a helpdesk user to list only the OUs I want, and at what level I need to set these permissions?

Thanks,

Alex

They need to be able to crawl through the domain and the OUs to get to where they need to. So you can apply the permissions at the domain level, but then disable inheritance for that policy link on the OU trees that they don't need to see. Alternatively, you can place all the relevant OUs into a Managed Unit, and grant access to just that Managed Unit, or place the relevant objects into Managed Units and do the same. 

Yep - good call on the Managed Unit suggestion.  Especially if you want to be really granular about where you grant access.  The MU will let you review that more easily too.

Yep - good call on the Managed Unit suggestion.  Especially if you want to be really granular about where you grant access.  The MU will let you review that more easily too.