Active Directory Cookbook

14.15. Enabling List Object Access Mode

Problem

You want to prevent any authenticated user from being able to browse the contents of Active Directory by default. Enabling List Object Access mode means users will need explicit permissions to see directory listings of containers.

Solution

Using a graphical user interface

1. Open ADSI Edit.

2. In the Configuration partition, browse to cn=Services → cn=Windows NT → cn=Directory Service.

3. In the left pane, right-click on the Directory Service object and select Properties.

4. Double-click on the dSHeuristics attribute.

5. If the attribute is empty, set it with the value: 001. If the attribute has an existing value, make sure the third bit (from the left) is set to 1.

6. Click OK twice.

Using VBScript

' This code enables or disables list object mode for a forest. ' ------ SCRIPT CONFIGURATION ------ boolEnableListObject = 1 ' e.g. 1 to enable, 0 to disable ' ------ END CONFIGURATION --------- set objRootDSE = GetObject("LDAP://RootDSE") set objDS = GetObject( _ "LDAP://cn=Directory Service,cn=Windows NT,cn=Services," _ & objRootDSE.Get("configurationNamingContext") ) strDSH = objDS.Get("dSHeuristics") if len(strDSH) = 1 then strDSH = strDSH & "0" end if strNewDSH = Left(strDSH,2) & boolEnableListObject if len(strDSH) > 3 then strNewDSH = strNewDSH & Right(strDSH, len(strDSH) - 3) end if WScript.Echo "Old value: " & strDSH WScript.Echo "New value: " & strNewDSH if strDSH <> strNewDSH then objDS.Put "dSHeuristics", strNewDSH objDS.SetInfo WScript.Echo "Successfully ...