Restricting MMC.

[boomam]

Hi.

Is there a way to restrict what parts of MMC users can access?

I do have a GPO in place that stops people accessing things like DNS/DHCP/whatnot, but i still allow teachers access to the AD for users so they can edit passwords. Is there a way to make restrictions within that as well though?

 

Thanks in advance all. .

[Diello]

Depends what you're trying to accumplish. If you want teachers to have access to change things in AD, then resticting MMC won't be of much use to use - you can restict what snapins they can load, whether they can edit within it or not, but after that, it's a free-for-all.

 

It sounds like you need to look into delegating AD control.

 

A good starting point: http://www.microsoft.com/downloads/details.aspx?FamilyID=631747a3-79e1-48fa-9730-dae7c0a1d6d3&DisplayLang=en

[boomam]

What i want to do is restrict what parts of users and computers they can access, and what they can and cant do.

For example, at the moment, they have full access to users and computers. So they can move things around, change passwords for anyone, etc;

I want to restrict it so that they can only change passwords for users in certain OUs. So that things in other OUs, and other functions, are denyed to them.

[Diello]

Definately want to looking into AD delegation then Exactly what it does.

 

Take a look at that MS documents & http://www.windowsecurity.com/articles/Implementing-Active-Directory-Delegation-Administration.html to get an idea.

[boomam]

Ive looked at that, and some other google articles.

All that appears to allow me to do is allow users to do things.

Theres no deny/hide functions in there.

 

I want staff to be only able to see the pupil OUs, and only be able to change passwords in it. Nothing else.

Every other OU, and functions like move/new/etc; i want to remove access to.

[ICTNUT]

I have this setup so ICT staff can change passwords and nothing else all using MMC and account delegation.

 

Attached is the document I give out to our ICT staff is this the sort of thing you are trying to do??

 

File Here

 

If so I will dig out the step by step instructions on how to set it up.

Edited January 8, 2008 by ICTNUT
Attachment not right

[boomam]

Using the delegate control thing on one test user and two test OUs.

Ive given the user password changing options on one OU, and using the advanced view in AD, changed the permissions on the other to deny everything.

Yet the user can still do everything in both OUs!?

[boomam]

Ah ha!

Ive managed to hide the OU by disabling the security permissions from inheriting from above.

Then removing all references to the test user, then re-adding the deny permission.

 

Im a little bit hesitant about applying the same technique to every folder in AD that i want to restrict though. Will it not cause problems?

[ICTNUT]

It all depends on what permissions the user has within AD, the way to get round this is to create a security group in AD i.e. ICT_Staff_PWD_Chg, use the account delegation wizard to allow this group only to change user passwords.

 

This way you can just add and remove users as you need without having to modify thier permissions.

 

This is how I have it setup and works fine.

[ICTNUT]

You may also want to take a look at creating custom MMC's or taskpads:

 

http://www.petri.co.il/create_taskpads_for_ad_operations.htm

 

And how to roll out custom adminpak.msi installations thus restricting what can be accessed further:

 

http://www.petri.co.il/extract_specific_tools_from_adminpak_msi.htm

[boomam]

It all depends on what permissions the user has within AD, the way to get round this is to create a security group in AD i.e. ICT_Staff_PWD_Chg, use the account delegation wizard to allow this group only to change user passwords.

 

This way you can just add and remove users as you need without having to modify thier permissions.

 

This is how I have it setup and works fine.

Thats what i would do.

But just focusing on the test user, its still allowing read/write access to everything else, even though in the delegation wizard thing i selected only password changing.

 

The way ive found to do what i want, is to remove inherit permissions from an OU, then remove the references to the test user, then re-add a deny full control. This removes that OU from the MMC when that user uses it.

 

Im hesitant to do this to all but the pupil OUs for fear of messing something up. For example, do the permissions for delegation (in regards to OU security), affect anything else but MMC access to those parts?

 

I dont want to spend 20mins denying the staff group access to everything in AD apart from the pupils OU, only to find that it messes up their ability to log on, print, access share, access programs, etc;

[ICTNUT]

What security rights do your staff have, mine are mere Domain Users thats it.

 

As a domain user there is little that you can do within ADUC anyhow.

 

I created a custom MMC and rolled that out to ICT IWB PC's without any problems, and although the options to disable accounts, delete accounts etc... still appear when you right click, selecting them gives you an access denied error.

 

If your staff have custom security permissions or are higher than mere domain users this could be the reason why they are still able to do the things you don't want.

 

Editing the folder permissions will have a knock on effect with other areas of AD hence the custom security group, and no having to edit permissions directly.

[boomam]

That little custom MMC program looks ideal.

Im trying to follow that guide, but its still showing me the entire AD in my custom MMC..

[boomam]

So i need to create commands and task views for every OU for the pupils!?

[ICTNUT]

I have my AD setup as follows:

 

Domain

|

Students OU

|

Year 7 OU

Year 8 OU

Year 9 OU

Year 10 OU

Year 11 OU

Year 12 OU

Year 13 OU

 

All my year OU's are within the Student OU

 

I then simply create the view pointing to the Students OU and INCLUDE all sub OU's thus eliminating the need to do per OU

 

If your setup is like this:

 

Domain

|

Year 7

|

Year 8

|

ETC

 

Where each year is it's own top level OU then yes would would need to select each OU on by one.

Edited January 8, 2008 by ICTNUT
Clarification

[boomam]

Ive worked it all out, and saved it in a MMC called 'Pupil Password Management'

But it wont open, for anyone, unless its run on the server.

 

Microsoft Management Console

MMC cannot copen the file XXXXXXX\Pupil Password Management v1.msc.

 

This may be because the file does not exist, is not an MMC console, or was created by a later version of MMC. This may also be because you do not have sufficient access rights to the file.

Edited January 8, 2008 by boomam

[boomam]

Sorted that, redid the mmc on my XP workstation.

 

Now the problem is that all the menu options under right click work.

How do i disable them all, apart from passwords?

[ICTNUT]

Did you save the file itself or a shortcut to the file??

 

Also was it done on the server?? The MMC on the server could be v3.0 but the desktops could be v2.0, this was a problem I ran into when I rolled mine out.

 

Download MMC 3.0 for XP SP2

[ICTNUT]

You need to login as a teacher that is likely to use this and test it that way.

 

Create a test user that you can delete, disable etc...

 

Right click will work regardless but if you select something that you do not have the rights to do it will give you access denied.

[boomam]

You need to login as a teacher that is likely to use this and test it that way.

 

Create a test user that you can delete, disable etc...

 

Right click will work regardless but if you select something that you do not have the rights to do it will give you access denied.

 

Sorted it, everything does appear, but nothing but properties & password actually work. Which is fine byme.

Just need to roll out MMC to every computer with just the snap-ins installing on each system, and not displaying shortcuts...

[ICTNUT]

Good to see you go it sorted

 

Take a look at the custom adminpak.msi install link I posted earlier this will show you exactly how to do it.

[boomam]

Good to see you go it sorted

 

Take a look at the custom adminpak.msi install link I posted earlier this will show you exactly how to do it.

 

I take that that the:

msiexec /i adminpak.msi ADDLOCAL=FeADTools /qb

command can be run as a startup script in a GPO?

Plus, what does the command switch "/qb" do. I'd like to find a list of command switches for that, but cant.

As i'd like to find the switches to make the install happen silently, and to add no shortcuts.

 

That 'staff' guide you created, in your first post, by any chance do you have the original template for that lying around in a format i can edit? Im too lazy to create one myself.

 

Thanks for all the help btw. Its been much appriciated. .

[Geoff]

Here's the technet article on msiexec command line options. Beware, it is long and complex.

 

http://technet2.microsoft.com/windowsserver/en/library/9361d377-9011-4e21-8011-db371fa220ba1033.mspx?mfr=true

[boomam]

Here's the technet article on msiexec command line options. Beware, it is long and complex.

 

http://technet2.microsoft.com/windowsserver/en/library/9361d377-9011-4e21-8011-db371fa220ba1033.mspx?mfr=true

 

Thanks.

Doesnt look like theres a command to set it so no shortcuts are installed, although changing the command to:

 

msiexec /i adminpak.msi ADDLOCAL=FeADTools /qn

 

Will hide the install process.

[Geoff]

Thanks.

Doesnt look like theres a command to set it so no shortcuts are installed

 

Normally, you need to alter the tables in the MSI (or use a transform) to prevent those sorts of operations. Have a look at ORCA.

 

http://support.microsoft.com/kb/255905