Comments on: Active Directory LDAP, Set Custom Security Persmissions on 3 Attributes, not the whole class http://itknowledgeexchange.techtarget.com/itanswers/active-directory-ldap-set-custom-security-persmissions-on-3-attributes-not-the-whole-class/ Wed, 22 May 2013 14:10:57 +0000 hourly 1 By: erroneousgiant http://itknowledgeexchange.techtarget.com/itanswers/active-directory-ldap-set-custom-security-persmissions-on-3-attributes-not-the-whole-class/#comment-94594 erroneousgiant Mon, 25 Jul 2011 15:27:19 +0000 #comment-94594 I’m just glad you didn’t use ‘Deny’ for Auth users. That would of been a no no.

I’m guessing your 3 attributes are top; person and user. (at least they are the default for 2003).

I don’t think that you can go a granular as the attributes of certain schema fields for permissions. AD premissions are designed more towards whether you can see, edit or delete objects rather than attributes. The finest grain permissions can be set in SACL of an object (advanced and then edit) but be careful f you aren’t sure abotu editing this.

Also ‘Ordinary logged on users’ should not be able to see anything in AD or the AD schema. Keep that to admins only. The only thing an ordinary user should be able to do is ref the global address book.

If anyone has any other suggestions i’d be glad to hear them.

]]>