O'Reilly logo

Active Directory Cookbook by Robbie Allen

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

14.15. Enabling List Object Access Mode

Problem

You want to prevent any authenticated user from being able to browse the contents of Active Directory by default. Enabling List Object Access mode means users will need explicit permissions to see directory listings of containers.

Solution

Using a graphical user interface

  1. Open ADSI Edit.

  2. In the Configuration partition, browse to cn=Services cn=Windows NT cn=Directory Service.

  3. In the left pane, right-click on the Directory Service object and select Properties.

  4. Double-click on the dSHeuristics attribute.

  5. If the attribute is empty, set it with the value: 001. If the attribute has an existing value, make sure the third bit (from the left) is set to 1.

  6. Click OK twice.

Using VBScript

' This code enables or disables list object mode for a forest. ' ------ SCRIPT CONFIGURATION ------ boolEnableListObject = 1 ' e.g. 1 to enable, 0 to disable ' ------ END CONFIGURATION --------- set objRootDSE = GetObject("LDAP://RootDSE") set objDS = GetObject( _ "LDAP://cn=Directory Service,cn=Windows NT,cn=Services," _ & objRootDSE.Get("configurationNamingContext") ) strDSH = objDS.Get("dSHeuristics") if len(strDSH) = 1 then strDSH = strDSH & "0" end if strNewDSH = Left(strDSH,2) & boolEnableListObject if len(strDSH) > 3 then strNewDSH = strNewDSH & Right(strDSH, len(strDSH) - 3) end if WScript.Echo "Old value: " & strDSH WScript.Echo "New value: " & strNewDSH if strDSH <> strNewDSH then objDS.Put "dSHeuristics", strNewDSH objDS.SetInfo WScript.Echo "Successfully ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required