How to restrict general domain users to query domain information

Question

How to restrict general domain users to query domain information

After the user joins the computer into the domain, after logging in, the user can obtain the information of users or groups in the domain through LDAP commands or PowerShell commands. How to restrict ordinary users to obtain such information.

Answer 1

Hi @ABDXJ

Have a look at these previous questions, which were trying to achieve same thing.

https://learn.microsoft.com/en-us/answers/questions/929688/best-practice-to-prevent-active-directory-enumerat.html

https://learn.microsoft.com/en-us/answers/questions/707421/ad-search-privileged-groups.html

I would also suggestion having a look at this article on restricting who can join machines to the domain:

https://social.technet.microsoft.com/wiki/contents/articles/5446.active-directory-how-to-prevent-authenticated-users-from-joining-workstations-to-a-domain.aspx
Gary.